CVE-2026-68770

This vulnerability in sentence-transformers fundamentally breaks the trust_remote_code security boundary. When you pass trust_remote_code=False to SentenceTransformer, the library loads models from the path you provide—but if that path exists on the local filesystem, the trust_remote_code flag is silently ignored and code execution proceeds anyway. The check in the library's import path resolves to 'if os.path.exists(path): allow_code_execution()'—filesystem presence has replaced the security decision you explicitly made. The vulnerable code path is triggered whenever you load a model from any local directory. This includes downloaded model caches, mounted volumes from model registries, or directories populated by data pipelines. In production ML deployments, these paths routinely contain files that originated externally—making the bypass trivially exploitable by any attacker who can write to a model directory, whether through compromised storage, registry tampering, or malicious pipeline artifacts. Your immediate actions: First, audit every call to SentenceTransformer() in your codebase and verify whether the model path could be influenced by any external or untrusted source. If a path comes from configuration, environment variables, or any source you don't fully control, treat it as potentially malicious. Second, add explicit validation before model loading—verify the model directory contents are expected and haven't been tampered with, using checksums or signature verification if available. Third, apply principle of least privilege to the process running model inference: it should have no write access to its own model directories, and ideally runs in a sandboxed environment. Detection is difficult because code execution during model loading is indistinguishable from normal inference startup in system metrics. Monitor for unexpected Python processes spawning from your inference service, and audit your model directories for any .py files that shouldn't be there—particularly __init__.py, modeling_*.py, or configuration files that can contain executable code. The library's intended design likely assumed 'local path' meant 'already vetted by the application,' but in modern deployments where storage is decoupled from compute (container volumes, cloud storage mounts, shared caches), that assumption no longer holds. Consider this when reviewing your threat model—if you relied on trust_remote_code=False as your primary defense, you need additional controls.

Reviewed through automated stages and approved by a human before publication.