PYSEC-2026-4164 sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

CLSA-2026-1790851862 TuxCare security update for sentence-transformers (1 CVE)

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post3+tuxcare...

PT-2026-105908

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.existsmodel na...

PT-2026-78714

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.2 Description An accounting defect exists in the join filter within src/filters/array.ts and the array to sentence string filter within src/filters/string.ts. The join filter calculates complexity based on...

CVE-2026-68770

A flaw was found in sentence-transformers. A remote attacker could exploit a logic flaw to bypass a security control designed to prevent the execution of untrusted code. This vulnerability allows for arbitrary code execution when an application loads a model from a directory that has been...

ROOT-APP-PYPI-CVE-2026-68770 CVE-2026-68770 in sentence-transformers - Patched by Root

Root has patched CVE-2026-68770 in the sentence-transformers package for Root:PyPI. Multiple fixed versions available...

CLSA-2025-1765930349 TuxCare security update for sentence-transformers (1 CVE)

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare...

PT-2026-73656

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare...

aait (>=2.0.0, <=2.3.14), accutuning-helpers (>=1.0.32, <=1.0.33) +78 more potentially affected by CVE-2026-68770 via sentence-transformers (>=5.0.0, <=5.5.1)

sentence-transformers PYPI version =5.0.0, =2.0.0, =1.0.32, =0.1.0, =2026.5.22, =3.1.0, =3.9.11, =0.10.0, =0.4.13, =0.1.3, =0.1.18, =0.2.1a0, =0.1.2, =0.1.0, =0.1.1 and more Source cves: CVE-2026-68770 Source advisory: SNYK:PYTHON-SENTENCETRANSFORMERS-18507657...

Arbitrary Code Injection

Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Injection through the importmoduleclass function in sentencetransformers/util/misc.py due to a logic flaw that allows the security guard to be bypassed if a loca...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

contextualized-topic-models (>=1.8.0, <=1.8.2) potentially affected by CVE-2026-68770 via sentence-transformers (0.4.1)

sentence-transformers PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.8.0, =1.8.2 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

contextualized-topic-models (1.4.2) potentially affected by CVE-2026-68770 via sentence-transformers (0.3.2)

sentence-transformers PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models 1.4.2 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

framework3 (>=1.0.10, <=1.2.1), linden (>=0.1.0, <=0.3.0) +4 more potentially affected by CVE-2026-68770 via sentence-transformers (4.0.2)

sentence-transformers PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - framework3 =1.0.10, =0.1.0, =0.1.0, =1.2.0, =22.7.0, =0.0.2, =1.0.2rc0 Source cves: CVE-2026-68770 Source advisory:...

aiology (0.0.4), argentic (>=0.6.0, <=0.8.20) +64 more potentially affected by CVE-2026-68770 via sentence-transformers (4.1.0)

sentence-transformers PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - aiology 0.0.4 - argentic =0.6.0, =0.1.5, =0.2.0, =0.5.9, =0.1.0, =0.1.1, =0.1.0a1, =0.8.0, =0.5.5, =0.2.0, =0.3.0,...

anyclassifier (>=0.1.1, <=0.2.0), autotrain-advanced (>=0.8.21, <=0.8.25) +23 more potentially affected by CVE-2026-68770 via sentence-transformers (3.1.1)

sentence-transformers PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - anyclassifier =0.1.1, =0.8.21, =0.2.2.dev0, =0.1.1, =3.0.0, =0.1.4, =1.0.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0,...

concept (>=0.0.1, <=0.2.1), semantic-search-faiss (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-68770 via sentence-transformers (1.2.0)

sentence-transformers PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - concept =0.0.1, =0.0.3, =0.1.0 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

chat-with-mlx (>=0.1.0, <=0.1.11), raga-llm-eval (>=2.0.0a12, <=2.0.0b27) +1 more potentially affected by CVE-2026-68770 via sentence-transformers (2.4.0)

sentence-transformers PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - chat-with-mlx =0.1.0, =2.0.0a12, =2.0.0b27 - ragcar 0.1.0 Source cves: CVE-2026-68770 Source advisory:...

askdoc (0.1.1), conflare (>=0.1.2, <=0.1.3) +6 more potentially affected by CVE-2026-68770 via sentence-transformers (2.3.1)

sentence-transformers PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - askdoc 0.1.1 - conflare =0.1.2, =0.1.9, =1.5.2.dev14, =0.1.0, =0.7.0 - raga-llm-eval 1.0.0 - team-comm-tools 0.1.0...