Disclosure summary
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-jhr6-gm9c-rqjv
Open original source · Updated Sep 30, 2026
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
Source severity: CRITICAL / 9.3
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | sentence-transformers | < 5.6.0 | 5.6.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-07-31T17:31:59-04:00
MODIFIED 2026-09-30T19:24:25-04:00
INGESTED 2026-10-06T11:43:09-04:00