LanceDB 0.41.0 stops trusting embedding settings stored in a table

LanceDB published v0.41.0 on 29 October. The change most teams will notice is in the Python SDK: embedding settings that come back from a table’s metadata are no longer trusted by default.

What the fix closes

A LanceDB table can store the embedding function used to build it, so a later process can embed new queries the same way. The fix, PR #4550, merged on 19 October, explains the problem in one line: embedding functions “are rebuilt from table metadata, which anyone who can write the table controls.”

Two things followed from that, in the PR’s words. Because sentence-transformers defaulted trust_remote_code to True, “opening and querying a crafted table ran arbitrary code from a model repository.” And metadata “could likewise point base_url at another server, sending it queries and the OPENAI_API_KEY from the environment.”

The PR cites advisory GHSA-x8v2-vj73-gfwm, which went public on the evening of 29 October: it rates the issue High (CWE-94, code injection), lists lancedb 0.40.0 and earlier on PyPI as affected and 0.41.0 as patched, and has no CVE number yet. Nothing in the release, the PR or the advisory says the issue was exploited.

What changes in 0.41.0

• SentenceTransformerEmbeddings.trust_remote_code now defaults to False.
• A restored function that needs remote code, or a custom endpoint (OpenAI base_url, an Ollama host or proxy, a watsonx URL), only works after the process approves it with get_registry().allow_remote_code(model, revision=...) or get_registry().allow_endpoint(url).
• Unapproved settings raise UntrustedEmbeddingConfigError when you compute embeddings. Other operations on the table keep working.
• Functions created in the same process are approved automatically. Trust is keyed by model name and can be pinned to a revision, so approving one model does not let a table swap in another.

The PR lists what it does not cover: TypeScript (“its built-ins have neither remote code nor configurable endpoints”), Bedrock assumed_role, and third-party embedding functions that do not implement the new hooks. LanceDB’s core is written in Rust, but every file this fix touches is in the Python SDK.

The same release carries other breaking changes, including list_databases returning an iterator, lazy iterators for several APIs, and the MemWAL APIs being renamed to RTE (realtime engine). Packages are out on PyPI and crates.io.

Why this matters

If your app opens LanceDB tables that someone else can write, such as a shared bucket or a downloaded dataset, upgrade and treat the table as configuration that can carry instructions, not only data. After upgrading, a job that reopens a table built with a remote-code model or a custom endpoint will raise until you add the matching allow_remote_code or allow_endpoint call, so test reopen-and-search paths before you deploy. It is the same lesson as our explainer on model weights that execute code, and the second LanceDB trust-boundary fix we have covered this month after the Cloud client table-name path traversal.