Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-68770: sentence-transformers may execute malicious code while loading a local model
CVE-2026-68770 · published 3 months ago
Summary
The sentence‑transformers library can run any program that an attacker places in a model folder on the same computer, even when the load call is set not to trust remote code. If someone can write files in that folder, those files will be executed when the model is loaded. Update to the newest version and only load models from directories you control, or verify the contents of the model files before loading.
What to do
- Update sentence-transformers to version 5.6.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | hugging face | sentence-transformers | <= 5.5.1 |
| pip | – | sentence-transformers |
< 5.6.0 Fix: upgrade to 5.6.0
|
Original advisory text
sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.
References
- https://github.com/huggingface/sentence-transformers/commit/ae1acc3fb2aa2004577b... Patch
- https://github.com/huggingface/sentence-transformers Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68770... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-68770 Vendor Advisory
- https://github.com/huggingface/sentence-transformers/pull/3807 Vendor Advisory
- https://github.com/advisories/GHSA-jhr6-gm9c-rqjv
- https://github.com/huggingface/sentence-transformers/issues/3801 Third Party Advisory
- https://github.com/huggingface/sentence-transformers/pull/3935
- https://github.com/huggingface/sentence-transformers/commit/626eb602b088878a8173...
- https://github.com/huggingface/sentence-transformers/releases/tag/v5.6.0
- https://pypi.org/project/sentence-transformers Product
- https://github.com/huggingface/sentence-transformers/releases/tag/v6.0.0
- https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execut... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-94Code Injection
Timeline
Published31 Jul 2026
Updated3 Nov 2026
First seen31 Jul 2026
Sources
CVE-2026-68770 · OSV
CVE-2026-68770 · NVD
CVE-2026-68770 · MITRE
GHSA-jhr6-gm9c-rqjv · GHSA
GHSA-jhr6-gm9c-rqjv · OSV
PYSEC-2026-4164 · OSV
Track software like this
Free during beta