sentence-transformers: local model directory executes Python despite trust_remote_code=False

Impact

The trust gate in import_module_class is satisfied by or os.path.exists(model_name_or_path), so any model that resolves to a local path is treated as trusted even when the caller explicitly passes trust_remote_code=False. Anyone who can write into a model directory the fleet loads from - a shared NFS or Lustre model cache, a per-tenant volume, an artifact sync job, a registry mirror - can drop a modeling_*.py referenced from modules.json and get code execution inside the loading process at import time. On an embedding or reranker fleet that process usually holds the GPU, the model cache credentials and the service account of the serving namespace, so this is a tenant-to-service or supply-chain-to-service step, not a crash. Operators who relied on trust_remote_code=False as their control for untrusted model artifacts did not have the control they thought they had.

Who can reach it

No authentication to the library itself: it is whoever can influence the contents of a model directory on disk that the serving process later loads, plus a normal SentenceTransformer(path) call. Reachable by any tenant or pipeline with write access to a shared model cache or model-artifact store.

What to do

Upgrade sentence-transformers to a release containing commit ae1acc3 (PR #3807) and restart every embedding, reranking and indexing worker that loads models; the fix removes the path-existence bypass. The record does not name a fixed version number, so pin against the commit or the first release after it rather than a guessed version. Until then treat write access to shared model directories as equivalent to code execution in the serving process: make model caches read-only to workloads, and stage third-party model downloads outside any path a serving process loads.

References

Related entries

• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
• Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical
• llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
• llama.cpp llama-server: use-after-free on the vocab pointer during idle sleep gives unauthenticated RCECVE-2026-43631 · llama.cpp llama-server (--sleep-idle-seconds idle transition)Critical
• Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical
• Qdrant (snapshot recovery): Arbitrary file read and write during snapshot recoveryCVE-2024-3829 · Qdrant (snapshot recovery)Critical