Critical, CVSS 9.3PyPIAmendedPublished
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
CVE-2026-68770 · GHSA-jhr6-gm9c-rqjv
- Affected
- PyPI sentence-transformers < 5.6.0
- Fixed in
- 5.6.0· Vendor fix available
- Issue
- sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or os.path.exists(modelnameorpath)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trustremotecode=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trustremotecode=False), bypassing the documented security contract and achieving code execution within the loading process.
Recommended action: Upgrade to 5.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.