CVE-2026-68770: sentence-transformers Security Control Bypass Enables RCE

Executive Summary

A critical security control bypass vulnerability (CVE-2026-68770) has been disclosed in the sentence-transformers Python library. A logic flaw in the import_module_class helper function located in sentence_transformers/util/misc.py allows attackers to bypass the trust_remote_code=False protection and achieve arbitrary code execution when a model is loaded from a path that exists on the local filesystem. The vulnerability carries a CVSS score of 9.8 (Critical).

Vulnerability Overview

Root Cause

The import_module_class helper is designed to load custom model classes while respecting the trust_remote_code parameter. The guard condition intended to block untrusted code contains a critical logic flaw:

# Flawed guard condition (simplified)
if trust_remote_code or os.path.exists(model_name_or_path):
    # load and execute custom class from model directory
    ...

The or os.path.exists(model_name_or_path) branch satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of whether trust_remote_code=False was explicitly set. An application that calls SentenceTransformer(path, trust_remote_code=False) with a local path is fully exposed — the documented security contract is violated.

Attack Scenario

1. Attacker gains write access to a model directory on the target filesystem
   (shared storage, container volume, temp dir via another vulnerability, etc.)
 
2. Attacker places malicious Python file: modeling_<name>.py
   (or modifies modules.json to reference a malicious class path)
 
3. Application loads the model:
   SentenceTransformer("/shared/models/my-model", trust_remote_code=False)
 
4. import_module_class() evaluates:
   trust_remote_code=False  OR  os.path.exists("/shared/models/my-model") → True
 
5. The OR condition passes — malicious class is imported and executed
   at load time, achieving arbitrary code execution as the application user

High-Risk Environments

Impact

A successful exploit grants the attacker arbitrary code execution within the context of the process running sentence-transformers. Depending on the deployment environment this can mean:

• Full system compromise of the inference server
• Exfiltration of model weights, training data, and API credentials
• Lateral movement to upstream/downstream ML pipeline components
• Persistent backdoor via custom model class modification

Remediation

Immediate Actions

1. Update sentence-transformers to a patched release as soon as one is published. Monitor the sentence-transformers GitHub releases page.

2. Restrict write access to model directories — ensure model directories loaded by your application cannot be modified by untrusted parties.

3. Audit model loading calls — search your codebase for SentenceTransformer( with local paths:

grep -rn "SentenceTransformer(" . --include="*.py" | grep -v "trust_remote_code=True"

4. Use explicit allow-listing — only load models from paths you control and have verified.

Temporary Mitigation (pre-patch)

If a patch is not yet available, avoid loading SentenceTransformer models from directories that any untrusted process, user, or container can write to:

import os
import stat
 
def safe_load_model(model_path: str):
    # Verify model directory is not world-writable
    st = os.stat(model_path)
    if st.st_mode & stat.S_IWOTH:
        raise PermissionError(f"Model path {model_path} is world-writable — refusing to load")
    return SentenceTransformer(model_path, trust_remote_code=False)

Detection

References

• TheHackerWire — CVE-2026-68770: sentence-transformers RCE via Security Control Bypass
• THREATINT — CVE-2026-68770
• NIST NVD — CVE-2026-68770

Related Reading

• CVE-2026-68771: ComfyUI Pickle Deserialization RCE