All vulnerabilities
CVE-2026-68770GHSA-jhr6-gm9c-rqjvPYSEC-2026-4164

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

Hugging Face sentence-transformerspipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 3 Aug 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.91%Chance of exploitation activity in the next 30 days, higher than 59% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.6.0Fixed versionGitHub
Published31 Jul 2026Updated 8 Oct 2026CVE List

What fixes it

  • 5.6.0sentence-transformers, pipGitHub
  • 5.6.0sentence-transformers, PyPIOSVpip install "sentence-transformers>=5.6.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

Text from CVE List

Affected versions 53

  • sentence-transformers, pip< 5.6.0GitHub
  • sentence-transformersaffected: all versions through 5.5.1CVE List
  • sentence-transformers, PyPIfrom first release, fixed in 5.6.0OSV
  • sentence-transformers, PyPI0.1.0OSV
  • sentence-transformers, PyPI0.2.0OSV
  • sentence-transformers, PyPI0.2.1OSV
  • sentence-transformers, PyPI0.2.2OSV
  • sentence-transformers, PyPI0.2.3OSV
  • sentence-transformers, PyPI0.2.4OSV
  • sentence-transformers, PyPI0.2.4.1OSV
  • sentence-transformers, PyPI0.2.5OSV
  • sentence-transformers, PyPI0.2.5.1OSV
  • sentence-transformers, PyPI0.2.6OSV
  • sentence-transformers, PyPI0.2.6.1OSV
  • sentence-transformers, PyPI0.2.6.2OSV
  • sentence-transformers, PyPI0.3.0OSV
  • sentence-transformers, PyPI0.3.1OSV
  • sentence-transformers, PyPI0.3.2OSV
  • sentence-transformers, PyPI0.3.3OSV
  • sentence-transformers, PyPI0.3.4OSV
  • sentence-transformers, PyPI0.3.5OSV
  • sentence-transformers, PyPI0.3.5.1OSV
  • sentence-transformers, PyPI0.3.6OSV
  • sentence-transformers, PyPI0.3.7OSV
  • sentence-transformers, PyPI0.3.7.1OSV
  • sentence-transformers, PyPI0.3.7.2OSV
  • sentence-transformers, PyPI0.3.8OSV
  • sentence-transformers, PyPI0.3.9OSV
  • sentence-transformers, PyPI0.4.0OSV
  • sentence-transformers, PyPI0.4.1OSV
  • sentence-transformers, PyPI0.4.1.1OSV
  • sentence-transformers, PyPI0.4.1.2OSV
  • sentence-transformers, PyPI1.0.0OSV
  • sentence-transformers, PyPI1.0.1OSV
  • sentence-transformers, PyPI1.0.2OSV
  • sentence-transformers, PyPI1.0.3OSV
  • sentence-transformers, PyPI1.0.4OSV
  • sentence-transformers, PyPI1.1.0OSV
  • sentence-transformers, PyPI1.1.1OSV
  • sentence-transformers, PyPI1.2.0OSV
  • sentence-transformers, PyPI1.2.1OSV
  • sentence-transformers, PyPI2.0.0OSV
  • sentence-transformers, PyPI2.1.0OSV
  • sentence-transformers, PyPI2.2.0OSV
  • sentence-transformers, PyPI2.2.1OSV
  • sentence-transformers, PyPI2.2.2OSV
  • sentence-transformers, PyPI2.3.0OSV
  • sentence-transformers, PyPI2.3.1OSV
  • sentence-transformers, PyPI2.4.0OSV
  • sentence-transformers, PyPI2.5.0OSV
  • sentence-transformers, PyPI2.5.1OSV
  • sentence-transformers, PyPI2.6.0OSV
  • sentence-transformers, PyPI2.6.1OSV

References 11