CVE-2026-68770
2 advisories.
PyPI/sentence-transformers CVE-2026-68770: critical 9.8, EPSS 0.91%
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
Action: Upgrade sentence-transformers to 5.6.0 or later.
pip install sentence-transformers==5.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.6.0 | - |
Fixed versions
| 5.6.0 |
Sources
- osv: GHSA-jhr6-gm9c-rqjv
- https://nvd.nist.gov/vuln/detail/CVE-2026-68770
- https://github.com/huggingface/sentence-transformers/issues/3801
- https://github.com/huggingface/sentence-transformers/pull/3807
- https://github.com/huggingface/sentence-transformers/pull/3935
- https://github.com/huggingface/sentence-transformers/commit/626eb602b088878a8173bcab69225f68411b99e1
- https://github.com/huggingface/sentence-transformers/commit/ae1acc3fb2aa2004577b297eb4a915ce7a03316a
- https://github.com/huggingface/sentence-transformers
- https://github.com/huggingface/sentence-transformers/releases/tag/v5.6.0
- https://github.com/huggingface/sentence-transformers/releases/tag/v6.0.0
- https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false
CVE-2026-68770 · published · modified · JSON
PyPI/sentence-transformers CVE-2026-68770: critical 9.8, EPSS 0.91%
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
Action: Upgrade sentence-transformers to 5.6.0 or later.
pip install sentence-transformers==5.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.6.0 | - |
Fixed versions
| 5.6.0 |
Sources
- osv: PYSEC-2026-4164
- https://nvd.nist.gov/vuln/detail/CVE-2026-68770
- https://github.com/huggingface/sentence-transformers/issues/3801
- https://github.com/huggingface/sentence-transformers/pull/3807
- https://github.com/huggingface/sentence-transformers/pull/3935
- https://github.com/huggingface/sentence-transformers/commit/626eb602b088878a8173bcab69225f68411b99e1
- https://github.com/huggingface/sentence-transformers/commit/ae1acc3fb2aa2004577b297eb4a915ce7a03316a
- https://github.com/huggingface/sentence-transformers
- https://github.com/huggingface/sentence-transformers/releases/tag/v5.6.0
- https://github.com/huggingface/sentence-transformers/releases/tag/v6.0.0
- https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false
- https://pypi.org/project/sentence-transformers
- https://github.com/advisories/GHSA-jhr6-gm9c-rqjv
CVE-2026-68770 · published · modified · JSON