PYSEC-2026-4164

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/sentence-transformers/PYSEC-2026-4164.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-4164

Aliases

Published

2026-10-01T16:38:29Z

Modified

2026-10-01T17:45:16Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

Details

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

References

Affected packages

PyPI / sentence-transformers

Package

Name: sentence-transformers; View open source insights on deps.dev
Purl: pkg:pypi/sentence-transformers

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.6.0

Affected versions

0.*

0.1.0

0.2.0

0.2.1

0.2.2

0.2.3

0.2.4

0.2.4.1

0.2.5

0.2.5.1

0.2.6

0.2.6.1

0.2.6.2

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.3.5.1

0.3.6

0.3.7

0.3.7.1

0.3.7.2

0.3.8

0.3.9

0.4.0

0.4.1

0.4.1.1

0.4.1.2

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.1.0

1.1.1

1.2.0

1.2.1

2.*

2.0.0

2.1.0

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.4.0

2.5.0

2.5.1

2.6.0

2.6.1

2.7.0

3.*

3.0.0

3.0.1

3.1.0

3.1.1

3.2.0

3.2.1

3.3.0

3.3.1

3.4.0

3.4.1

4.*

4.0.0

4.0.1

4.0.2

4.1.0

5.*

5.0.0

5.1.0

5.1.1

5.1.2

5.2.0

5.2.1

5.2.2

5.2.3

5.3.0

5.4.0

5.4.1

5.5.0

5.5.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/sentence-transformers/PYSEC-2026-4164.yaml"