Loading story…
A critical vulnerability tracked as CVE-2026-68770 affects Hugging Face's sentence-transformers package and allows arbitrary code execution when a model is loaded from a local path, even if applications explicitly set trust_remote_code=False. The flaw stems from a logic error in the import_module_class helper in sentence_transformers/util/misc.py, where an or os.path.exists(model_name_or_path) condition accepts existing local filesystem paths and can cause malicious Python code referenced through modules.json to run during import. The issue is classified as CWE-94 and carries a CVSS 3.1 score of 9.8, with high impact to confidentiality, integrity, and availability.
The bug affects sentence-transformers through version 5.5.1 and creates a significant AI/ML supply-chain risk for organizations that load models from disk or from directories an attacker can influence. Reporting indicates no active exploitation had been confirmed at publication, but maintainers have released a fix, with coverage pointing to version 5.6.1 as the remediated release. Organizations using local model-loading workflows are being urged to upgrade immediately and tighten controls around model directories, stored artifacts, and any process that imports untrusted model content.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The critical vulnerability CVE-2026-68770 was published, disclosing that sentence-transformers versions up to and including 5.5.1 are affected by a logic flaw in import_module_class that enables arbitrary code execution from local model paths.
VulnCheck's disclosure address received CVE-2026-68770, a sentence-transformers vulnerability involving a trust_remote_code=False bypass that can lead to arbitrary code execution during local model loading.
Coverage of the vulnerability states that the issue has been fixed in a recent sentence-transformers release, specifically version 5.6.1, and points to an associated fixing commit and pull request in the project repository.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw in Hugging Face's `transformers` library allowed attacker-controlled model repositories to run arbitrary code during the standard `from_pretrained()` loading process, even when `trust_remote_code=False` was set. The issue was tied to unsafe handling of untrusted model configuration data, including nested configuration resolution in the LightGlue loading path, where values from `config.json` could override the intended safety setting and trigger execution of attacker-supplied Python modules during model initialization. Reports said the vulnerability affected `transformers` versions `4.56.0` through `5.2.x` in environments where the `kernels` package was installed, with version `5.2.0` specifically cited in LightGlue-related exploitation scenarios. Exposed targets included inference servers, research notebooks, CI/CD pipelines, and automated model evaluation systems, where successful compromise could enable theft of cloud credentials, API keys, SSH keys, proprietary datasets, lateral movement, persistence, and backdoor deployment. Hugging Face released a fix in `transformers` `5.3.0` and urged organizations to upgrade and treat model loading as a code execution surface.
Jun 29, 2026
A critical remote code execution vulnerability, tracked as **`CVE-2026-58116`**, affects **LLaMA-Factory** through version **0.9.5**. The flaw is in the WebUI **Chat** and **Training** interfaces, where user-supplied **Model path** input is passed to Hugging Face model-loading functions with **`trust_remote_code=True`**, allowing attacker-controlled code from a remote or local model repository to run with the privileges of the server process. Public reporting said the issue is remotely exploitable and carries a **CVSS 3.1 score of 9.8** and **CVSS 4.0 score of 9.3**. The vulnerability was publicly described as a model path injection issue that can be triggered by pointing the WebUI at a malicious Hugging Face repository containing crafted Python files executed during model loading. Reports said there is no UI option or configuration setting to disable the unsafe behavior in affected versions, expanding exposure across both interfaces. Recommended mitigations include updating LLaMA-Factory, sanitizing model path input, disabling **`trust_remote_code`** where possible, and restricting WebUI access to authorized users only.
Jun 30, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-49655, has been identified in the Keras machine learning framework, specifically affecting versions 3.11.0 up to but not including 3.11.3. The flaw arises from unsafe deserialization of untrusted data within the TorchModuleWrapper class, which can be exploited when a maliciously crafted Keras file is loaded. This vulnerability allows attackers to execute arbitrary code on the victim's system, even if Keras is running in safe mode, significantly increasing the risk profile for users who routinely load external or shared model files. The issue can be triggered through both local and remote files, making it exploitable in a variety of deployment scenarios, including cloud-based and on-premises environments. The vulnerability has been assigned a CVSS v3.1 base score of 9.8, categorizing it as critical due to the ease of exploitation and the potential impact. Security researchers have highlighted that the attack does not require authentication, and exploitation can occur simply by loading a malicious model file. The vulnerability was publicly disclosed in October 2025, with security advisories urging immediate action. At the time of disclosure, the affected product versions were clearly identified, but some databases had not yet listed all impacted vendors or products. The Keras development team has released a patch in version 3.11.3 to address the issue, and users are strongly advised to upgrade to this version or later. Organizations using Keras in production or research environments should audit their model loading workflows and restrict the use of untrusted model files. The vulnerability underscores the broader risks associated with deserialization flaws in machine learning frameworks, which are increasingly targeted due to their widespread adoption. Security teams are encouraged to monitor for suspicious activity related to model file handling and to implement additional controls where feasible. The incident has prompted renewed calls for secure coding practices and rigorous input validation in AI and machine learning software. The rapid response from the Keras maintainers has been noted, but the incident serves as a warning for similar frameworks to review their own deserialization logic. The vulnerability's critical rating reflects both the technical severity and the potential for widespread exploitation if left unaddressed. Industry experts recommend that all organizations using Keras review their current deployments and apply the necessary updates without delay. The disclosure of CVE-2025-49655 has also led to increased scrutiny of third-party model sharing platforms, which may inadvertently distribute malicious files. This event highlights the importance of maintaining up-to-date software and following best practices for secure machine learning operations.
Jun 29, 2026