A logic flaw in Hugging Face's sentence-transformers library lets a local model directory execute arbitrary Python at load time even when the application explicitly passes trust_remote_code=False.
What Is It
CVE-2026-68770 is a security control bypass leading to arbitrary code execution (CWE-94) in the sentence-transformers library. The flaw lives in the import_module_class helper in sentence_transformers/util/misc.py. The guard that is supposed to enforce the trust boundary includes an or os.path.exists(model_name_or_path) clause; meaning the trust gate is satisfied whenever the supplied path simply exists on the local filesystem, regardless of the trust_remote_code=False argument.
An attacker who can control or influence the contents of a model directory on disk can drop malicious Python files, for example modeling_*.py referenced via modules.json, which are then imported and executed when an application calls SentenceTransformer(path, trust_remote_code=False). Code runs inside the loading process.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a secondary CVSS 4.0 score of 9.3 (CRITICAL). Per the CVSS 3.1 vector as recorded in the CVE entry, the metrics are network attack vector, low attack complexity, no privileges required and no user interaction, with high confidentiality, integrity, and availability impact.
The core problem is that trust_remote_code=False is the documented safety contract developers rely on when loading third-party or untrusted models. This bug silently voids that contract for any model already on disk, turning a defensive setting into a false sense of security.
What's Vulnerable
- Vendor: Hugging Face
- Product: sentence-transformers
- Affected versions: all versions up to and including 5.5.1 (semver, default status: affected)
Patch Status
CVE-2026-68770 is not listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-07-31, so there is no federal confirmation of active exploitation and no KEV-mandated remediation deadline. Upstream remediation is tracked in commit ae1acc3, issue #3801, and pull request #3807 in the sentence-transformers repository. The CVE record was published 2026-07-31 and remains in Received status pending NVD analysis.
Sources
- NVD, CVE-2026-68770: https://nvd.nist.gov/vuln/detail/CVE-2026-68770
- VulnCheck Advisory; sentence-transformers arbitrary code execution on local model load despite trust_remote_code=False: https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- GitHub; huggingface/sentence-transformers: https://github.com/huggingface/sentence-transformers
- GitHub Commit ae1acc3: https://github.com/huggingface/sentence-transformers/commit/ae1acc3fb2aa2004577b297eb4a915ce7a03316a
- GitHub Issue #3801: https://github.com/huggingface/sentence-transformers/issues/3801
- GitHub Pull Request #3807: https://github.com/huggingface/sentence-transformers/pull/3807