Which versions of sentence-transformers are affected by CVE-2026-68770?

Hugging Face sentence-transformers, a widely-deployed Python library for machine learning inference, contains a critical vulnerability (CVE-2026-68770) that enables arbitrary code execution when…

How to fix or mitigate CVE-2026-68770?

Within 24 hours: Inventory all production systems using sentence-transformers via dependency scanning (pip freeze, requirements.txt, poetry.lock), identify external model exposure, and implement network isolation for critical systems. Within 7 days: Develop remediation plan with engineering teams to either migrate to alternative embedding libraries or stage a controlled v6.0 upgrade when released; audit model-load history for potential compromise indicators. Within 30 days: Complete migration to patched v6.0 or alternative library, enforce models sourced exclusively from internally-controlled repositories, and implement mandatory security review for model-loading code changes.

sentence-transformers CVE-2026-68770

Q: What is the CVSS score of CVE-2026-68770?

CVE-2026-68770 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-51650 CRITICAL

Code Injection (CWE-94)

2026-07-31 disclosure@vulncheck.com

GHSA-jhr6-gm9c-rqjv

RCE Python Code Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Attacker-controlled model is network-deliverable (AV:N/AC:L/PR:N) but requires the victim application to load the untrusted model directory (UI:R); code runs in-process yielding full C:H/I:H/A:H, no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 21:31 vuln.today

Analysis Generated

Jul 31, 2026 - 21:31 vuln.today

CVE Published

Jul 31, 2026 - 21:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

Articles & Coverage 2

News 7 New Python Vulnerabilities - 2 Critical, 5 High, 1 With POC Aug 01, 2026 News Critical RCE in Hugging Face sentence-transformers (Python) - CVE-2026-68770 Jul 31, 2026

AnalysisAI

Arbitrary code execution in the Hugging Face sentence-transformers Python library allows attackers who control the contents of a model directory to run code even when the caller explicitly passes trust_remote_code=False. The import_module_class helper in sentence_transformers/util/misc.py short-circuits its trust gate with an 'or os.path.exists(model_name_or_path)' clause, so any local path that exists satisfies the check and triggers dynamic loading of custom Python (e.g. modeling_*.py referenced in modules.json) at model-load time. This is classic CWE-94 code injection with no public exploit identified at time of analysis; the vendor commit deprecates rather than removes the behavior, deferring the actual fix to v6.0.

Technical ContextAI

sentence-transformers is a widely used Python framework built on Hugging Face Transformers/PyTorch for producing text and image embeddings, semantic search, and reranking, and is a common component in RAG pipelines. Custom model architectures are supported via a modules.json manifest that references Python module classes (such as modeling_custom.CustomTransformer), which are loaded through transformers' get_class_from_dynamic_module - a mechanism that imports and executes arbitrary repository code. Hugging Face gates this dynamic execution behind the trust_remote_code flag as a documented security contract. The root cause (CWE-94, Improper Control of Generation of Code) is a flawed guard condition in import_module_class: the clause 'or os.path.exists(model_name_or_path)' treats the mere existence of a local path as implicit trust, so the dynamic import proceeds regardless of trust_remote_code=False whenever the model is loaded from disk.

RemediationAI

Important caveat: the referenced upstream fix (commit ae1acc3, PR #3807) does NOT remove the vulnerable 'or os.path.exists(model_name_or_path)' short-circuit - it only adds a FutureWarning deprecating the implicit trust of local directories, with the actual enforcement (requiring trust_remote_code=True for local custom code) explicitly deferred to sentence-transformers v6.0 per the in-code TODO. Therefore, upgrading to a version that merely contains this commit will emit a warning but will still execute local custom code; treat this as 'Upstream fix available (PR/commit); released patched version not independently confirmed' and plan to move to v6.0 once released for real enforcement. Until then, apply compensating controls: only load models from trusted, integrity-verified sources and never point SentenceTransformer() at directories writable by untrusted users or processes (trade-off: constrains automated model-download workflows); enforce strict filesystem permissions on model cache/model directories so attackers cannot place or modify modeling_*.py files or modules.json (trade-off: operational overhead in shared/CI environments); vet modules.json and any modeling_*.py in third-party model repos before loading, or run model loading in a sandboxed/least-privilege container with no sensitive credentials so code execution is contained (trade-off: added deployment complexity). Track the vendor advisory (VulnCheck) and issue #3801 for the v6.0 release that removes the short-circuit.