p PatchFirst

CVE-2026-68770

CVE-2026-68770 · sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

CVSS 9.3 · Crítica · EPSS 0,9% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • sentence-transformers

    Versiones
    • ≥ 0, ≤ 5.5.1: Afectada (semver)

    Sin corrección publicada

  • sentence-transformers PyPI

    Versiones
    • 0.1.0
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.4.1
    • 0.2.5
    • 0.2.5.1
    • 0.2.6
    • 0.2.6.1
    • 0.2.6.2
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.5.1
    • 0.3.6
    • 0.3.7
    • 0.3.7.1
    • 0.3.7.2
    • 0.3.8
    • 0.3.9
    • 0.4.0
    • 0.4.1
    • 0.4.1.1
    • 0.4.1.2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.6.0
    • 2.6.1
    • 2.7.0
    • 3.0.0
    • 3.0.1
    • 3.1.0
    • 3.1.1
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.3.1
    • 3.4.0
    • 3.4.1
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 5.0.0
    • 5.1.0
    • 5.1.1
    • 5.1.2
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.3.0
    • 5.4.0
    • 5.4.1
    • 5.5.0
    • 5.5.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 5.6.0

    Actualiza a 5.6.0

Fuentes originales

Comprueba tu servidor →