A flaw in the import_module_class helper in the sentence-transformers library bypasses the trust_remote_code guard when the supplied model path exists locally. The guard condition includes an unnecessary or os.path.exists clause, allowing a local attacker to place malicious Python modules referenced in modules.json. When the SentenceTransformer constructor is invoked with trust_remote_code=False, these modules are imported at load time, resulting in arbitrary code execution in the application's process space. The vulnerability is associated with both CWE‑94, a code injection issue, and CWE‑454, a logic flaw that leads to unintended privilege escalation.

All releases of Hugging Face's sentence‑transformers that contain the unpatched import_module_class implementation. Specific version numbers are not provided, but any version before the fix is vulnerable.

The CVSS score of 9.3 signals a high‑severity flaw involving a logic error (CWE‑454) and code injection (CWE‑94). The EPSS score of <1% indicates that the current exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation campaigns yet. Based on the description, it is inferred that the primary attack vector is local filesystem; an attacker must control or influence the contents of a model directory on disk. Based on the description, it is also inferred that the potential for remote code execution exists if an application loads user‑supplied model directories from untrusted sources. The vulnerability can be exploited by dropping malicious Python files into a model folder and loading that model, causing the application to execute those files at import time.