PYSEC-2026-4164 sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

CLSA-2026-1790851862 TuxCare security update for sentence-transformers (1 CVE)

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post3+tuxcare...

PT-2026-105908

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.existsmodel na...

CVE-2026-68770

A flaw was found in sentence-transformers. A remote attacker could exploit a logic flaw to bypass a security control designed to prevent the execution of untrusted code. This vulnerability allows for arbitrary code execution when an application loads a model from a directory that has been...

ROOT-APP-PYPI-CVE-2026-68770 CVE-2026-68770 in sentence-transformers - Patched by Root

Root has patched CVE-2026-68770 in the sentence-transformers package for Root:PyPI. Multiple fixed versions available...

CLSA-2025-1765930349 TuxCare security update for sentence-transformers (1 CVE)

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare...

PT-2026-73656

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare...

aait (>=2.0.0, <=2.3.14), accutuning-helpers (>=1.0.32, <=1.0.33) +78 more potentially affected by CVE-2026-68770 via sentence-transformers (>=5.0.0, <=5.5.1)

sentence-transformers PYPI version =5.0.0, =2.0.0, =1.0.32, =0.1.0, =2026.5.22, =3.1.0, =3.9.11, =0.10.0, =0.4.13, =0.1.3, =0.1.18, =0.2.1a0, =0.1.2, =0.1.0, =0.1.1 and more Source cves: CVE-2026-68770 Source advisory: SNYK:PYTHON-SENTENCETRANSFORMERS-18507657...

Arbitrary Code Injection

Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Injection through the importmoduleclass function in sentencetransformers/util/misc.py due to a logic flaw that allows the security guard to be bypassed if a loca...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

GHSA-JHR6-GM9C-RQJV sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

agi-med-metrics (>=0.0.1, <=0.0.7), agi-med-utils (0.0.1) +12 more potentially affected by CVE-2026-68770 via sentence-transformers (2.5.1)

sentence-transformers PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - agi-med-metrics =0.0.1, =1.0.0, =0.0.10, =1.6.2.dev25, =1.0.1, =0.2.0, =1.0.0, =0.6.6, =0.7.0 Source cves:...

contextualized-topic-models (>=2.0.0, <=2.1.1) potentially affected by CVE-2026-68770 via sentence-transformers (1.1.1)

sentence-transformers PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =2.0.0, =2.1.1 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

amapy-server (>=1.0.1, <=1.0.2), arm-rag-testing (>=0.0.1, <=7.7.9) +16 more potentially affected by CVE-2026-68770 via sentence-transformers (3.2.1)

sentence-transformers PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - amapy-server =1.0.1, =0.0.1, =0.8.26, =0.0.1, =0.1.1, =0.1.5, =0.5.0, =0.1.3, =1.0.2, =1.0.11 and more Source cves:...

pdf2emb-nlp (0.1.3), pdf2embeddings (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-68770 via sentence-transformers (0.2.5.1)

sentence-transformers PYPI version 0.2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - pdf2emb-nlp 0.1.3 - pdf2embeddings =0.1.0, =0.1.1 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQ...

document-qa-engine (>=0.4.0, <=0.6.0), explainitall (>=1.0.0, <=1.0.2) +8 more potentially affected by CVE-2026-68770 via sentence-transformers (2.6.1)

sentence-transformers PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - document-qa-engine =0.4.0, =1.0.0, =1.2.0, =0.0.14, =0.1.1, =0.1.3, =0.0.2, =0.0.3, =0.0.2, =0.1.5 Source cves:...

aait (>=0.0.4.80, <=1.0.5), aiagents4pharma (>=0.0.0, <=1.49.1) +34 more potentially affected by CVE-2026-68770 via sentence-transformers (3.3.1)

sentence-transformers PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - aait =0.0.4.80, =0.0.0, =0.1.8, =0.0.0, =1.2.5, =0.8.34, =0.1.0, =0.1.2, =0.2.1 and more Source cves: CVE-2026-68770...

askdoc (0.1.1), conflare (>=0.1.2, <=0.1.3) +6 more potentially affected by CVE-2026-68770 via sentence-transformers (2.3.1)

sentence-transformers PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - askdoc 0.1.1 - conflare =0.1.2, =0.1.9, =1.5.2.dev14, =0.1.0, =0.7.0 - raga-llm-eval 1.0.0 - team-comm-tools 0.1.0...

framework3 (>=1.0.10, <=1.2.1), linden (>=0.1.0, <=0.3.0) +4 more potentially affected by CVE-2026-68770 via sentence-transformers (4.0.2)

sentence-transformers PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - framework3 =1.0.10, =0.1.0, =0.1.0, =1.2.0, =22.7.0, =0.0.2, =1.0.2rc0 Source cves: CVE-2026-68770 Source advisory:...