CVE-2026-68770 in sentence-transformers
Summary
by MITRE • 08/01/2026
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The sentence-transformers library presents a critical security control bypass vulnerability that fundamentally undermines its intended security model for remote code execution prevention. This flaw exists within the import_module_class helper function located in sentence_transformers/util/misc.py, where a faulty guard condition creates an exploitable logic flaw that allows attackers to circumvent the trust_remote_code=False parameter. The vulnerability stems from the inclusion of an 'or os.path.exists(model_name_or_path)' clause that effectively neutralizes the security boundary designed to prevent arbitrary code execution when loading models from local filesystem paths.
The technical implementation of this vulnerability exploits a fundamental misalignment between the library's security assumptions and its actual code execution flow. When applications call SentenceTransformer with trust_remote_code=False, the library should refuse to execute any Python code contained within model directories. However, the flawed guard condition evaluates whether the specified path exists locally on the filesystem and, if so, automatically grants access to the code execution pathway regardless of the trust_remote_code parameter value. This creates a direct bypass mechanism that allows attackers to place malicious Python files in model directories with names such as modeling_*.py, which are then referenced through modules.json configuration files.
The operational impact of this vulnerability extends far beyond simple privilege escalation, representing a complete breakdown of the security contract that developers rely upon when using the sentence-transformers library. Attackers who can influence or control model directory contents on disk can inject malicious code that executes during the import process when applications load models, effectively achieving arbitrary code execution within the context of the loading application. This bypass occurs at runtime when the SentenceTransformer class attempts to load and initialize models, making it particularly dangerous as it operates within the normal application flow without triggering typical security monitoring mechanisms.
The vulnerability aligns with CWE-862, which describes "Missing Authorization" in software systems, and maps directly to ATT&CK technique T1059.001 for executing malicious code through command-line interfaces. The flaw represents a logic error that violates the principle of least privilege by allowing code execution when the system should enforce strict security boundaries. Security professionals must understand that this vulnerability affects not just individual applications but entire ecosystems where sentence-transformers is used for natural language processing tasks, particularly in environments where model loading occurs from untrusted sources or user-controlled directories.
Mitigation strategies should focus on immediate patching of the library to correct the guard condition logic and ensure that trust_remote_code=False consistently prevents code execution regardless of filesystem path existence. Organizations should implement strict file access controls and directory permissions for model storage locations, while also considering runtime monitoring solutions that can detect unauthorized code loading activities. Additionally, developers must adopt defensive programming practices that validate all input parameters against security policies before executing potentially dangerous operations, particularly when dealing with dynamic module loading scenarios that could expose applications to remote code execution attacks.
The broader implications of this vulnerability highlight the critical importance of proper security testing for machine learning libraries and frameworks, where the interaction between model loading processes and security controls can create unexpected attack vectors. This flaw demonstrates how seemingly innocuous path existence checks can undermine sophisticated security mechanisms when not properly integrated into comprehensive access control policies. Security teams must remain vigilant about similar logic flaws in other libraries that handle dynamic code loading or module execution, as these represent common attack surfaces that can be exploited to achieve arbitrary code execution within legitimate application contexts.