CVE-2026-68770 | Hugging Face sentence-transformers up to 5.5.1 Import Module Class Helper misc.py import_module_class model_name_or_path code injection

A vulnerability was found in Hugging Face sentence-transformers up to 5.5.1 and classified as problematic. Affected by this issue is the function import_module_class of the file sentence_transformers/util/misc.py of the component Import Module Class Helper. Executing a manipulation of the argument model_name_or_path can lead to code injection.

The identification of this vulnerability is CVE-2026-68770. The attack can only be executed locally. There is no exploit available.