External risk intelligence

Sentence-Transformers Local Model Load Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-68770

This vulnerability exists in a library function that processes local files. The attack requires the attacker to control the contents of a directory on the local filesystem of the server. It is not an internet-facing service, API, or network-reachable endpoint; it is a code-level library vulnerability typically triggered during application-side data processing.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security control bypass vulnerability in the sentence-transformers library. The flaw allows attackers to execute arbitrary code by manipulating local model files, even when remote code execution is intended to be disabled. This bypasses intended security measures and could lead to code execution during the model loading process.

Local code execution flaw found in a data processing library.
Critical flaw bypasses security when loading models.
Confirm relevance and exposure of local model loading.

Attack Path

How an attacker could exploit the issue

An attacker can trick an application into running malicious code by manipulating local files. This occurs when an application loads a SentenceTransformer model from a controlled directory, even when configured to avoid remote code execution. The flaw bypasses a security check if the model path exists locally, allowing the attacker's code to run during the import process.

Attacker influences local model directory contents.
Application loads model with `trust_remote_code=False`.
Arbitrary code execution is achieved.

Live Threat

Current exploitation, exposure, and threat context

When an application loads a model using the SentenceTransformer library with `trust_remote_code=False`, a logic flaw in the `import_module_class` helper can be exploited. This occurs when an attacker can influence the contents of a local model directory, allowing them to place malicious Python files that execute at import time, bypassing security checks.

Local model files could be compromised.
Malicious code executes during model import.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for code that loads models using the `sentence-transformers` library should investigate. The first practical step is to identify all instances where this library is used, confirm whether the affected function is reachable or handles business-critical data, and then coordinate with development and security teams to plan remediation based on assessed risk.

Application owners must identify usage.
Verify critical data paths.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the sentence-transformers library?

Sentence-transformers is a popular Python library used by developers to convert text into numerical vectors, known as embeddings. These vectors allow applications to perform tasks like semantic search, text clustering, and natural language processing. It frequently interacts with pre-trained AI models, which can be stored locally or downloaded from repositories, making it a foundational tool for integrating advanced machine learning capabilities into custom software projects.

What is the vulnerability in CVE-2026-68770?

This vulnerability is a security control bypass categorized as Improper Control of Generation of Code (CWE-94). It occurs because the library’s trust mechanism incorrectly prioritizes the existence of a local file path over security settings. Even when a developer explicitly sets 'trust_remote_code=False' to block unsigned code execution, the flawed logic allows the software to import and run arbitrary Python scripts if they are present in the model directory being loaded.

How can an attacker trigger this vulnerability?

An attacker must be able to place or modify files within a directory that the application subsequently loads as a model. The trigger relies on the application attempting to load a model from that specific path. This vulnerability does not trigger if the application only loads models from trusted, immutable sources that the attacker cannot influence, or if the directory containing the model files is protected from unauthorized write access.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates it is very unlikely your application is directly exposed to external network attacks via this flaw. Because the vulnerability exists in a library function that processes local files, it typically requires an attacker to already have access to your server's filesystem. It is not an internet-facing network service, so the risk is generally localized to environments where untrusted users can influence the contents of local model directories.

What steps should I take if I use this library?

Start by auditing your codebase to locate all instances where your application calls the SentenceTransformer class to load models. Verify if your application allows users or external processes to upload, create, or modify files within the directories used for these model loads. If such write access exists, restrict permissions immediately to ensure only trusted system processes can modify files in those locations while you coordinate with your development team on an update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.