CVE-2026-68770
CRITICAL · 9.8Real vuln, high CVSS, but no KEV, no confirmed PoC, no defender triage signal yet.
What: sentence-transformers (Hugging Face) contains a logic flaw in import_module_class that bypasses trust_remote_code=False, allowing arbitrary code execution if attackers control a local model directory. CVSS 9.8 CRITICAL.
Why it matters: Published 31 July 2026; chatter erupted same day across security channels. The vulnerability breaks a documented security contract—developers relying on trust_remote_code=False to safely load untrusted models are exposed. No KEV listing yet, PoC status unclear from posts, but the flaw is straightforward (os.path.exists logic gate) and exploitable by anyone with filesystem access to model dirs. Real threat to ML pipelines, but patch status unknown.
Where it's seen: Security news aggregators and threat radar platforms amplifying the NVD description; no working exploit code or active in-the-wild reports visible. Vendor advisory not yet cited in posts.
RISK: CRITICAL — Logic flaw breaks security contract; local attacker can execute code bypassing intended safeguards.
Description
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weaknesses
References
- https://github.com/huggingface/sentence-transformers
- https://github.com/huggingface/sentence-transformers/commit/ae1acc3fb2aa2004577b297eb4a915ce7a03316a
- https://github.com/huggingface/sentence-transformers/issues/3801
- https://github.com/huggingface/sentence-transformers/pull/3807
- https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false