PT-2026-66862 · Hugging Face · Sentence-Transformers

Bofei Chen · CVE-2026-68770 · Published 2026-07-31 · Updated 2026-07-31

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model name or path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust remote code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling *.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust remote code=False), bypassing the documented security contract and achieving code execution within the loading process.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-68770

Affected Products

Sentence-Transformers

References · 6

• https://github.com/huggingface/sentence-transformers/pull/3807 · Vendor Advisory
• https://github.com/huggingface/sentence-transformers/commit/ae1acc3fb2aa2004577b297eb4a915ce7a03316a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-68770 · Security Note
• https://github.com/huggingface/sentence-transformers/issues/3801 · Note
• https://github.com/huggingface/sentence-transformers · Note
• https://vulncheck.com/advisories/sentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false · Note