One clean line in a manifest,
and the RCE it never mentioned.
Speaker diarization is the unglamorous layer under call transcription, meeting notes and compliance recording: who spoke, and when. pyannote's models are the default choice, pulled millions of times a month, and they name one Python package as their library. That package is clean. This is the story of what it brings with it.
-
Jun 30, 2026
A clean release
pyannote-audio 4.0.7ships. Its dependency list is short and ordinary, and one line in it readslightning>=2.4: a floor, and no ceiling. The pyannote models we watch namepyannote-audioas their library. One of them, speaker-diarization-3.1, also ships arequirements.txtpinningpyannote-audio==3.1.1, whose own floor,lightning>=2.0.1, is just as open. Runpyannote-audio 4.0.7through CyberXYZ on its own and it comes back with zero signals. It is, genuinely, clean. -
Jul 15, 2026
The turn: a checkpoint that runs code
GitHub publishes GHSA-qqmf-gpg7-g8gw (CVE-2026-58659, CVSS 3.1 7.8, HIGH). PyTorch Lightning's
_load_stateimports and executes whatever module name a checkpoint's_instantiatorhyperparameter points at. A crafted checkpoint file, the very artifact people download and share to use these models, becomes arbitrary code execution on load, even withweights_only=True. Every release before 2.6.6 is affected, up to and including 2.6.5, the current release that day. No fixed release had shipped yet. -
Same day
What a manifest scanner sees
Nothing. The models never name
lightning. Their one declared dependency has no advisory against it. A tool that reads requirements files, and stops there, reports eight clean models. That is not a bug in those tools; it is the boundary of what a manifest can tell you. -
Attacker
A checkpoint is the payload
Picture a call-center analytics team. Their transcription pipeline pulls a pyannote model, and a colleague shares a fine-tuned checkpoint that "works better on our accents". Checkpoints are just files; people trade them. An attacker who plants one, on a model hub, in a shared drive, in a pull request, sets its
_instantiatorhyperparameter to a module they control. The next time anyone loads it through the pipeline,lightningimports and executes that module. No exploit kit, no network trick: a file the victim wanted, opened by code they trusted, through a package they never knew they had. -
Sep 6, 2026
The connection · the closure fires
On Sep 3, GitHub reviewed the advisory and mapped it to the
lightningpackage on PyPI. Around Sep 6, CyberXYZ connected it to these models. We resolve each model to the whole install, not the manifest: whatpip install pyannote-audioactually puts on the machine, at the versions that resolve that day. The path is short:pyannote/segmentation-3.0 → pyannote-audio 4.0.7 → lightning 2.6.5Depth one. Required, not optional. The floor
>=2.4admits 2.6.5, the advisory range covers 2.6.5, and nothing pins it lower. The finding is version-confirmed: not "this package has had a CVE once", but "the version a fresh install lands on is the vulnerable one." That held from Jul 15 until Sep 10. -
Same day
Eight models change colour
On the AI Models surface the eight pyannote models we watched, rated CLEAN on their declared surface, moved to HIGH, with the reason recorded: one confirmed finding in the transitive closure. The prediction layer filed them under a single attack vector, vulnerable by inheritance, at 7.0 out of 10. Three more pyannote models we added on Sep 9 rated HIGH for the same reason, eleven in all. The declared-only rating is kept beside the new one, so the change is visible, not silent.
-
Mapping
MITRE ATLAS and ATT&CK
This is an AI supply-chain technique first: ATLAS AML.T0010.003 (ML Supply Chain Compromise: Model) delivers the poisoned checkpoint, and AML.T0011.000 (User Execution: Unsafe ML Artifacts) is the moment it runs. The path into the machine is a classic software dependency: ATT&CK T1195.001 (Compromise Software Dependencies), executed through T1204.002 (User Execution: Malicious File) and T1059.006 (Python). The weakness class is CWE-470, unsafe reflection.
-
At install
The verdict · alert
Ask the firewall about
lightning@2.6.5directly and it answers alert: the HIGH advisory matches that version, advisory XYZ score 4.2, and it suggests 2.6.6 instead. Not a block. A HIGH advisory with no public exploit and a local attack vector is a warning, and the platform says so rather than inflating it. The card below is that answer, re-checked on Oct 8, 2026. -
Sep 10, 2026
The fix ships, and what to do
Lightning releases 2.6.6 with the fix (commit d710d68). A fresh install now resolves to it, and our data rates the eight models CLEAN again. The exposure was real while it lasted: for 57 days, from Jul 15 to Sep 10, a fresh install of these models landed on a vulnerable lightning. If you pin lightning, or built an environment in that window, upgrade to
lightning>=2.6.6, or add it as a constraint until pyannote-audio raises its floor, which still admits the vulnerable releases. Keep treating checkpoint files from anywhere you do not control as untrusted input, and load them only in an isolated environment. And read the whole install, because the exposure that matters most is usually the one nobody wrote down.