p PatchFirst

CVE-2026-68770

CVE-2026-68770 · sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

This page contains facts from public vulnerability sources. Check the original advisory before updating.

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

CVSS 9.3 · Critical · EPSS 0.9% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • sentence-transformers

    Versions
    • ≥ 0, ≤ 5.5.1: Affected (semver)

    No fix published

  • sentence-transformers PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.4.1
    • 0.2.5
    • 0.2.5.1
    • 0.2.6
    • 0.2.6.1
    • 0.2.6.2
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.5.1
    • 0.3.6
    • 0.3.7
    • 0.3.7.1
    • 0.3.7.2
    • 0.3.8
    • 0.3.9
    • 0.4.0
    • 0.4.1
    • 0.4.1.1
    • 0.4.1.2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.6.0
    • 2.6.1
    • 2.7.0
    • 3.0.0
    • 3.0.1
    • 3.1.0
    • 3.1.1
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.3.1
    • 3.4.0
    • 3.4.1
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 5.0.0
    • 5.1.0
    • 5.1.1
    • 5.1.2
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.3.0
    • 5.4.0
    • 5.4.1
    • 5.5.0
    • 5.5.1
    Affected ranges
    • ECOSYSTEM: < 5.6.0

    Update to 5.6.0

Original sources

Check your server →