Junglewise Threat Intelligence

CVE-2026-68770: Hugging Face sentence-transformers code execution via trust_remote_code bypass

CVE-2026-68770 · Severity: critical · CVSS 9.8 · Published 2026-07-31

Executive brief

Hugging Face sentence-transformers, a popular library for generating AI text embeddings, contains a security flaw that allows for arbitrary code execution. The library is designed to block untrusted code from running unless specifically permitted by the user; however, a logic error causes it to automatically trust and execute any code found within a model directory if that directory exists on the local disk. An attacker who can influence the contents of a model folder (e.g., through a shared drive, a downloaded archive, or a model registration API) can execute malicious commands on the underlying system when the application attempts to load the model.

Technical details

A logic flaw exists in the 'import_module_class' helper within 'sentence_transformers/util/misc.py'. The guard condition intended to enforce the 'trust_remote_code' security gate contains an 'or os.path.exists(model_name_or_path)' clause. This short-circuit causes the library to satisfy the trust requirement whenever the model path exists on the local filesystem, bypassing the user's 'trust_remote_code=False' configuration. An attacker can exploit this by placing a malicious Python file (e.g., 'modeling_*.py') in a model directory and referencing it via 'modules.json'. When 'SentenceTransformer(path, trust_remote_code=False)' is called, the library will dynamically import and execute the attacker's code. A fix involving a FutureWarning was introduced in version 5.5.1+, with a full removal of the vulnerable logic planned for v6.0.

Affected products

  • Hugging Face sentence-transformers <= 5.5.1

Timeline

  • 2026-06-09: other: Vulnerability reported and fix proposed in PR 3807
  • 2026-06-12: patched: Initial mitigation (FutureWarning) merged into main branch
  • 2026-07-31: advisory: CVE-2026-68770 published

References