One clean line in a manifest,
and the RCE it never mentioned.
Speaker diarization is the unglamorous layer under call transcription, meeting notes and compliance recording: who spoke, and when. pyannote's models are the default choice, pulled millions of times a month, and they ask for exactly one Python package. That package is clean. This is the story of what it brings with it.
-
Jun 30, 2026
A clean release
pyannote-audio 4.0.7ships. Its dependency list is short and ordinary, and one line in it readslightning>=2.4: a floor, and no ceiling. Every pyannote model on HuggingFace declarespyannote-audioas its loader and nothing else. Run the package through CyberXYZ on its own and it comes back with zero signals. It is, genuinely, clean. -
Jul 15, 2026
The turn: a checkpoint that runs code
GitHub publishes GHSA-qqmf-gpg7-g8gw (CVE-2026-58659, CVSS 7.8, HIGH). PyTorch Lightning's
_load_stateimports and executes whatever module name a checkpoint's_instantiatorhyperparameter points at. A crafted checkpoint file, the very artifact people download and share to use these models, becomes arbitrary code execution on load. Every released version through 2.6.5, the current one, is affected. The fix exists as a commit; no fixed release has shipped. -
Same day
What a manifest scanner sees
Nothing. The models never name
lightning. Their one declared dependency has no advisory against it. A tool that reads requirements files, and stops there, reports eight clean models. That is not a bug in those tools; it is the boundary of what a manifest can tell you. -
Attacker
A checkpoint is the payload
Picture a call-center analytics team. Their transcription pipeline pulls a pyannote model, and a colleague shares a fine-tuned checkpoint that "works better on our accents". Checkpoints are just files; people trade them. An attacker who plants one, on a model hub, in a shared drive, in a pull request, sets its
_instantiatorhyperparameter to a module they control. The next time anyone loads it through the pipeline,lightningimports and executes that module. No exploit kit, no network trick: a file the victim wanted, opened by code they trusted, through a package they never knew they had. -
Every hour
The catch · the closure fires
CyberXYZ resolves each model to the whole install, not the manifest: what
pip install pyannote-audioactually puts on the machine, at the versions that resolve today. The path is short:pyannote/speaker-diarization-3.1 → pyannote-audio 4.0.7 → lightning 2.6.5Depth one. Required, not optional. The floor
>=2.4admits 2.6.5, the advisory range covers 2.6.5, and nothing pins it lower. The finding is version-confirmed: not "this package has had a CVE once", but "the version a fresh install lands on today is the vulnerable one." -
T+0
Eight models change colour
On the AI Models surface every pyannote model that rated CLEAN on its declared surface now rates HIGH, with the reason recorded: one confirmed finding in the transitive closure. The prediction layer files them under a single attack vector, vulnerable by inheritance, at 7.0 out of 10. The declared-only rating is kept beside the new one, so the change is visible, not silent.
-
Mapping
MITRE ATLAS and ATT&CK
This is an AI supply-chain technique first: ATLAS AML.T0010.003 (ML Supply Chain Compromise: Model) delivers the poisoned checkpoint, and AML.T0011.000 (User Execution: Unsafe ML Artifacts) is the moment it runs. The path into the machine is a classic software dependency: ATT&CK T1195.001 (Compromise Software Dependencies), executed through T1204.002 (User Execution: Malicious File) and T1059.006 (Python). The weakness class is CWE-470, unsafe reflection.
-
At install
The verdict · alert
Ask the firewall about
lightning@2.6.5directly and it answers alert: the HIGH advisory matched on the resolved version, XYZ score 4.2. Not a block. A HIGH advisory with no public exploit and a local attack vector is a warning, and the platform says so rather than inflating it. The card below is that answer, unedited. -
Today
The aftermath, and what to do
There is no lightning release to upgrade to yet. Until there is: treat checkpoint files from anywhere you do not control as untrusted input, load them only in an isolated environment, and watch the upstream fix. Package maintainers can add a ceiling to a floor-only pin. And read the whole install, because the exposure that matters most is usually the one nobody wrote down.