sentence-transformers EUVD-2026-51650

Exploitation requires the attacker to control or influence the contents of a model directory on the victim's local filesystem - specifically the ability to place or modify a modules.json that references an attacker-supplied custom module (e.g. modeling_*.py) - and the victim application must then load that directory via SentenceTransformer(path) using a local path that exists on disk. The bypass fires precisely because trust_remote_code=False is ignored for existing local paths, so it works against the ostensibly 'safe' default the developer opted into. Limiting factors that reduce real-world risk: this is not exploitable against a remote service with no attacker file influence - the attacker needs a write/supply-chain foothold over the model directory (untrusted downloaded models, shared or world-writable model caches, compromised model registries, or CI artifacts); loading only first-party, trusted, integrity-verified models from read-only storage prevents exploitation. It affects the load-from-local-path code path with custom (non-sentence-transformers-namespace) module classes.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) rates this critical with full confidentiality, integrity, and availability impact and no privileges or interaction required. That rating is optimistic relative to the described mechanics: exploitation is not a network-reachable service bug but requires the attacker to control or influence the contents of a model directory that a victim application then loads - a supply-chain / untrusted-model prerequisite rather than blind remote exploitation. No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation probability and active-exploitation signals are unknown; there is no public exploit identified at time of analysis and no evidence of in-the-wild use. The realistic priority is high for any environment that loads third-party, downloaded, or shared-filesystem models under the false assurance of trust_remote_code=False, and low for environments that only load first-party, trusted, integrity-verified models. Note the tension: CVSS PR:N/UI:N implies default-config remote compromise, but the description implies the victim must be induced to load an attacker-influenced model - verify against the VulnCheck advisory before treating this as unauthenticated network RCE.

An attacker publishes or tampers with a sentence-transformers model repository so its modules.json references a malicious modeling_backdoor.py; a victim service downloads or syncs that model to local disk and calls SentenceTransformer(path, trust_remote_code=False), believing the flag prevents custom code execution. Because the path exists on disk, the trust gate is bypassed and the attacker's Python runs at import time within the loading process's privileges. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization straightforward once an attacker can influence any loaded model directory.