CVE-2026-68770: sentence-transformers RCE Vulnerability

CVE-2026-68770 Overview

CVE-2026-68770 is a security control bypass in the sentence-transformers library that allows arbitrary code execution when loading a local model. The flaw resides in the import_module_class helper within sentence_transformers/util/misc.py. A guard condition includes an or os.path.exists(model_name_or_path) clause that satisfies the trust gate whenever the supplied path exists on the local filesystem. This behavior overrides the explicit trust_remote_code=False argument. Attackers who can write to or influence a model directory can place malicious modeling_*.py files referenced from modules.json. The code executes at import time when the application calls SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract [CWE-94].

Critical Impact
Attackers achieve arbitrary code execution within the process loading the model, defeating the trust_remote_code=False safeguard developers rely on.

Affected Products

Hugging Face sentence-transformers library (Python)
Applications invoking SentenceTransformer() on locally reachable model directories
ML pipelines and services that load third-party or user-supplied model artifacts

Discovery Timeline

2026-07-31 - CVE-2026-68770 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-68770

Vulnerability Analysis

The sentence-transformers library exposes a trust_remote_code argument intended to gate execution of custom Python modules that ship alongside a model. Developers who pass trust_remote_code=False expect that no repository-local Python code will run during model load. The import_module_class helper in sentence_transformers/util/misc.py short-circuits this control when the model path resolves to a local directory. Because the guard uses an or os.path.exists(model_name_or_path) clause, any existing local path satisfies the trust check. The loader then imports repository-local modules such as modeling_<name>.py referenced from modules.json, executing attacker-controlled Python at import time. This vulnerability is categorized as Arbitrary Code Execution.

Root Cause

The root cause is a logic flaw in the trust gate. The predicate treats local presence on disk as an implicit sign of trust, which conflates path availability with user intent. As a result, the explicit trust_remote_code=False parameter is ignored whenever the path exists locally, breaking the documented security contract.

Attack Vector

An attacker who can write to or influence a directory that will later be passed to SentenceTransformer(path, trust_remote_code=False) stages a modules.json file plus a malicious modeling_*.py module. When the target application loads the model, Python import machinery executes the attacker's code inside the loading process. Distribution channels include shared network mounts, unpacked archives from untrusted sources, container images, and CI/CD workspaces that consume third-party model bundles.

python

# Patched behavior in sentence_transformers/util/misc.py (excerpt)
#     ``model_name_or_path`` resolves to a local directory (i.e. the user already has the
#     file on disk and is implicitly trusted).
#
# .. deprecated:: 5.6
#     The implicit trust of local directories is deprecated and will be removed in v6.0.
#     From v6.0, loading repository-local custom code will require ``trust_remote_code=True``,
#     matching the behavior for models loaded from the Hugging Face Hub. A ``FutureWarning`` is
#     emitted whenever a local model is loaded via this short-circuit without
#     ``trust_remote_code=True``.
#
# Args:
#     class_ref: Dotted class path. Either a fully-qualified ``sentence_transformers.*``
#         path or a repository-local reference like ``modeling_<name>.<ClassName>``.

Source: GitHub Commit ae1acc3. The patch adds a FutureWarning when local custom code is loaded without trust_remote_code=True, and announces removal of the implicit trust in v6.0.

Detection Methods for CVE-2026-68770

Indicators of Compromise

Presence of modeling_*.py or other Python modules inside model directories loaded by applications.
modules.json files referencing repository-local class paths such as modeling_<name>.<ClassName>.
Unexpected child processes, outbound network connections, or file writes originating from Python interpreters that load sentence-transformers.

Detection Strategies

Scan model directories for Python source files and flag any that were introduced from untrusted sources.
Inspect modules.json for entries pointing to repository-local modules rather than fully qualified sentence_transformers.* paths.
Instrument the Python process to log import events for modules loaded from model directories.

Monitoring Recommendations

Log and alert on file creations of modeling_*.py or edits to modules.json within any directory that feeds ML inference services.
Monitor ML worker hosts for anomalous process trees, unusual outbound connections, and credential access from the Python runtime.
Track library versions in production and CI to confirm all sentence-transformers installs meet the patched release.

How to Mitigate CVE-2026-68770

Immediate Actions Required

Upgrade sentence-transformers to a release that addresses the trust gate flaw as merged in Pull Request #3807.
Audit all local paths passed to SentenceTransformer() and remove any Python files not authored or reviewed by your team.
Restrict write access to model directories using filesystem permissions so only trusted identities can stage models.

Patch Information

The fix is tracked in GitHub Issue #3801 and applied in commit ae1acc3 via Pull Request #3807. The patch emits a FutureWarning when local custom code loads without trust_remote_code=True and signals removal of the implicit local-trust short-circuit in v6.0. Additional context is provided in the VulnCheck Advisory on Sentence Transformers.

Workarounds

Load models only from directories under exclusive control of the application, mounted read-only where possible.
Verify model bundles with cryptographic signatures or checksums before making them available to loaders.
Run model-loading workloads in isolated containers or sandboxes with least-privilege network and filesystem access.
Strip or reject any modeling_*.py files from third-party model archives before use.

bash

# Configuration example: pin a patched release and validate model contents before load
pip install --upgrade 'sentence-transformers>=5.6'

# Reject third-party model bundles that ship Python code
find /opt/models -type f -name '*.py' -print

# Enforce read-only model directories for the service account
chown -R root:mlsvc /opt/models
chmod -R 0550 /opt/models