sentence-transformers trust_remote_code Bypass Leading to Arbitrary Code Execution

Technical Analysis

The vulnerability resides in the import_module_class helper within sentence_transformers/util/misc.py, where the trust gate logic incorrectly includes an 'or os.path.exists(model_name_or_path)' clause, causing the trust check to pass whenever the given path exists locally, regardless of the trust_remote_code flag. An attacker who can influence the contents of a model directory (via a poisoned shared cache, a compromised model download/mirror, a malicious pull request to a model repo, or a supply-chain-tainted artifact) can drop a malicious modeling_*.py file referenced from modules.json, which executes as soon as SentenceTransformer(path, trust_remote_code=False) is called. This is a full security-control bypass (CVSS 9.8) resulting in code execution within the process loading the model, with no need for the attacker to control the trust_remote_code parameter itself. sentence-transformers is heavily used as an embedding backbone in RAG pipelines and AI agent frameworks (e.g., LangChain, LlamaIndex, custom retrieval agents), so any agent system that loads locally cached or shared embedding models is directly exposed to arbitrary code execution, credential theft (API keys, cloud tokens used by the agent), and lateral movement within the host running the agent.

Affected Systems

sentence-transformers Python package (all versions containing the flawed import_module_class logic in sentence_transformers/util/misc.py); applications and AI/RAG/agent pipelines that call SentenceTransformer(path, trust_remote_code=False) or similar loading functions on locally-resolved model paths, including shared model caches, mounted volumes, and Hugging Face Hub cache directories.

Indicators of Compromise

• modules.json (malicious references to attacker-controlled modeling_*.py)
• modeling_*.py (unexpected/unsigned Python files in model directories)
• Unexpected outbound network connections initiated during model load
• Unauthorized process spawning from Python ML training/inference hosts
• Modified or newly created files in ~/.cache/torch/sentence_transformers or Hugging Face cache directories

Remediation Steps

1. 1

   Upgrade sentence-transformers

   Update to a patched version of sentence-transformers once released by maintainers that removes the os.path.exists bypass from the trust gate logic.

2. 2

   Restrict model directory permissions

   Ensure model directories and caches are not writable by untrusted users or processes, and validate the provenance and integrity of any model artifacts before loading.

3. 3

   Enforce strict trust_remote_code handling

   Do not rely solely on trust_remote_code=False for security; explicitly audit modules.json and any referenced Python files before loading models, especially in agent/RAG pipelines that dynamically fetch or cache models.

4. 4

   Isolate model loading

   Run model loading and inference in sandboxed, least-privilege containers or VMs to limit the blast radius of arbitrary code execution.

5. 5

   Monitor for anomalous file and process activity

   Deploy file integrity monitoring on model cache directories and monitor for unexpected process execution or network activity during model load operations.

6. 6

   Vet model sources

   Only load models from verified, trusted repositories and pin exact commit hashes/checksums for embedding models used in production RAG and agent pipelines.