CVE-2026-68770: Sentence Transformers trust gate

CISO Take

sentence-transformers, a library used across most RAG and embedding pipelines, has a logic flaw where the trust_remote_code=False safeguard is silently bypassed whenever the supplied model path already exists on local disk, letting a modules.json reference to a malicious modeling_*.py file execute arbitrary code at load time. This matters because trust_remote_code=False is the documented, widely-relied-upon control teams use to safely load third-party or user-supplied models — this bug means that control has never actually protected local-path loads, a false sense of security with a 9.8 CVSS and no privileges or user interaction required. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than actively exploited, but the fix is already public (huggingface/sentence-transformers PR #3807, commit ae1acc3) so a reverse-engineered PoC is plausible soon. Upgrade to the patched release referenced in PR #3807 immediately, and in the meantime treat any model directory as untrusted unless your application fully controls its provenance and write access — don't rely on trust_remote_code=False alone as a security boundary for locally-cached or shared model paths.

Sources: NVD GitHub Advisory ATLAS github.com vulncheck.com

What is the risk?

The CVSS 9.8 (network, low complexity, no privileges, no user interaction) reflects worst-case severity of the resulting code execution, but real-world exploitability hinges on an attacker's ability to influence what ends up in a directory that gets passed to SentenceTransformer() as a local path — for example a shared model cache, a writable volume mounted by multiple tenants, a compromised model download/mirror, or a CI/build step that stages models before serving. Any of these are common in production AI pipelines (shared NFS caches, multi-tenant inference services, containers built from unpinned model artifacts), so the attack surface is broader than it first appears despite requiring a write primitive rather than pure network exposure. With no KEV listing, no EPSS score, and no known public exploit, there is currently no evidence of active exploitation, but the vulnerability defeats a documented security control (trust_remote_code=False) that many organizations depend on as their primary defense against malicious models — that alone elevates urgency for any team using this library in RAG, embeddings, or semantic search.

How does the attack unfold?

Supply chain staging

Attacker gains the ability to write to a directory that the victim application will later load as a local model path (shared cache, compromised mirror, stale container layer).

AML.T0010.003

Malicious artifact placement

Attacker plants a modules.json referencing a malicious modeling_*.py file embedded with arbitrary code inside the model directory.

AML.T0018.002

Trust gate bypass and execution

Victim application calls SentenceTransformer(path, trust_remote_code=False); the flawed 'or os.path.exists()' guard treats the existing local path as trusted, importing and executing the malicious module.

AML.T0011.000

Code execution impact

Attacker achieves arbitrary code execution inside the model-loading process, enabling credential theft, lateral movement, or embedding/data poisoning.

AML.T0050

Supply chain staging

Attacker gains the ability to write to a directory that the victim application will later load as a local model path (shared cache, compromised mirror, stale container layer).

AML.T0010.003

Malicious artifact placement

Attacker plants a modules.json referencing a malicious modeling_*.py file embedded with arbitrary code inside the model directory.

AML.T0018.002

Trust gate bypass and execution

Victim application calls SentenceTransformer(path, trust_remote_code=False); the flawed 'or os.path.exists()' guard treats the existing local path as trusted, importing and executing the malicious module.

AML.T0011.000

Code execution impact

Attacker achieves arbitrary code execution inside the model-loading process, enabling credential theft, lateral movement, or embedding/data poisoning.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Sentence Transformers	pip	—	No patch
19.1K OpenSSF 6.2 3.0K dependents Pushed 8d ago 0% patched Full package profile →

Do you use Sentence Transformers? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade sentence-transformers to the version containing the fix referenced in commit ae1acc3fb2aa2004577b297eb4a915ce7a03316a / PR #3807 as soon as it's available in your dependency manifest. Until patched, avoid loading models from any local path whose contents you do not fully control and audit — treat local model directories with the same suspicion as trust_remote_code=True, regardless of the flag's stated value. As a workaround, pre-scan model directories for unexpected modules.json entries pointing to modeling_*.py or other executable Python files before load, restrict write permissions on shared model caches to trusted build pipelines only, and run model-loading services in a sandboxed/least-privilege container so a code-execution primitive there doesn't grant broader access. Detection: monitor for unexpected child processes or outbound connections spawned immediately after SentenceTransformer() import calls, and alert on new or modified .py files appearing in cached model directories outside of your normal model-deployment pipeline.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Supply Chain Model Inference Framework AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third-party and customer relationships / AI system supply chain

NIST AI RMF

GOVERN 6.1 - Third-party risks and supply chain management

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-68770?

sentence-transformers, a library used across most RAG and embedding pipelines, has a logic flaw where the trust_remote_code=False safeguard is silently bypassed whenever the supplied model path already exists on local disk, letting a modules.json reference to a malicious modeling_*.py file execute arbitrary code at load time. This matters because trust_remote_code=False is the documented, widely-relied-upon control teams use to safely load third-party or user-supplied models — this bug means that control has never actually protected local-path loads, a false sense of security with a 9.8 CVSS and no privileges or user interaction required. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than actively exploited, but the fix is already public (huggingface/sentence-transformers PR #3807, commit ae1acc3) so a reverse-engineered PoC is plausible soon. Upgrade to the patched release referenced in PR #3807 immediately, and in the meantime treat any model directory as untrusted unless your application fully controls its provenance and write access — don't rely on trust_remote_code=False alone as a security boundary for locally-cached or shared model paths.

Is CVE-2026-68770 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-68770, increasing the risk of exploitation.

How to fix CVE-2026-68770?

Upgrade sentence-transformers to the version containing the fix referenced in commit ae1acc3fb2aa2004577b297eb4a915ce7a03316a / PR #3807 as soon as it's available in your dependency manifest. Until patched, avoid loading models from any local path whose contents you do not fully control and audit — treat local model directories with the same suspicion as trust_remote_code=True, regardless of the flag's stated value. As a workaround, pre-scan model directories for unexpected modules.json entries pointing to modeling_*.py or other executable Python files before load, restrict write permissions on shared model caches to trusted build pipelines only, and run model-loading services in a sandboxed/least-privilege container so a code-execution primitive there doesn't grant broader access. Detection: monitor for unexpected child processes or outbound connections spawned immediately after SentenceTransformer() import calls, and alert on new or modified .py files appearing in cached model directories outside of your normal model-deployment pipeline.

What systems are affected by CVE-2026-68770?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, embedding services, vector databases, model serving, semantic search.

What is the CVSS score for CVE-2026-68770?

CVE-2026-68770 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.65%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesembedding servicesvector databasesmodel servingsemantic search

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

Exploitation Scenario

An attacker compromises a location the target application treats as a source of local models — for example a shared model cache on NFS/EFS, a container base image with a stale model layer, or a self-hosted model mirror used by an internal MLOps pipeline. The attacker plants a model directory containing a modules.json that references a malicious modeling_backdoor.py alongside otherwise legitimate-looking model files. When the target application later calls SentenceTransformer(cached_path, trust_remote_code=False) — believing this flag protects it — the flawed guard sees that the path exists locally, treats it as implicitly trusted, and imports the malicious module, executing the attacker's code inside the embedding/inference service. From there the attacker can exfiltrate vector database credentials, pivot to other services reachable from the inference host, or quietly poison future embeddings generated by the compromised process.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.