AIKIDO-2026-434417

sentence-transformers is vulnerable to Code Injection

Code InjectionCVE-2026-68770 Published 2 days ago

Critical Risk

This Affects:

sentence-transformers

2.3.0 - 5.5.1

Fixed in 5.6.0

Are you affected? Scan for Free

TL;DR

The import_module_class helper in sentence_transformers/util/misc.py gates dynamic loading of repository-provided model classes behind a check that also passes whenever the supplied model path exists on the local filesystem. That short-circuit ignores trust_remote_code=False, so loading a model from a local directory imports and runs custom Python such as modeling_*.py files referenced from modules.json. Custom code placed in a model directory whose contents are influenced by an untrusted source therefore executes inside the loading process, bypassing the documented trust boundary and achieving arbitrary code execution. Version 5.6.0 is only a preparation for the real fix: it still allows the insecure local-path short-circuit and only emits a FutureWarning when local custom code is loaded without trust_remote_code=True. The real remediation, requiring explicit trust_remote_code=True for that path and matching transformers, is planned for v6.0.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you load a model from a local filesystem path whose directory contents can be influenced by an untrusted source.

Background info

sentence-transformers is vulnerable to Code Injection in versions 2.3.0 - 5.5.1.

How to fix this

Upgrade the sentence-transformers library to the patch version. Note that 5.6.0 is only a preparation for the real fix: it does not block the insecure pattern, but emits a FutureWarning when local custom code is loaded without trust_remote_code=True, so you can tell whether you are at risk. Until v6.0 enforces the trust gate, only load local model directories from trusted sources, or pass trust_remote_code=True only after inspecting any repository-provided Python in the directory.