Search
Find a vulnerability
Search criteria
4 vulnerabilities by unslothai
CVE-2026-112075 (GCVE-0-2026-112075)
Vulnerability from nvd – Published: 2026-10-19 03:45 – Updated: 2026-10-19 16:36 X_Open Source
VLAI
EPSS
VEX
Title
unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
Summary
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421754 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421754/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112075 | third-party-advisory |
| https://vuldb.com/submit/1009576 | third-party-advisory |
| https://github.com/unslothai/unsloth/issues/12419 | issue-tracking |
| https://github.com/unslothai/unsloth/pull/11560 | issue-trackingpatch |
| https://github.com/user-attachments/files/3290831… | exploit |
| https://github.com/unslothai/unsloth/commit/de801… | patch |
| https://github.com/unslothai/unsloth/releases/tag… | patch |
| https://github.com/unslothai/unsloth/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112075",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:35.739324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:42.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:unslothai:unsloth:*:*:*:*:*:*:*:*"
],
"product": "unsloth",
"vendor": "unslothai",
"versions": [
{
"status": "affected",
"version": "0.1.501-beta"
},
{
"status": "unaffected",
"version": "0.1.902-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck99 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "Use of Externally-Controlled Input to Select Classes or Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T03:45:20.785Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421754 | unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421754"
},
{
"name": "VDB-421754 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421754/cti"
},
{
"name": "CVE-2026-112075 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112075"
},
{
"name": "Submit #1009576 | Unsloth AI Unsloth up to 2026.9.11 (commit de801746386a53a0cb26216e715a0af863b76ad9) Unsafe Reflection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009576"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth/issues/12419"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/unslothai/unsloth/pull/11560"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32908312/poc.zip"
},
{
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/unslothai/unsloth/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T15:51:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112075",
"datePublished": "2026-10-19T03:45:20.785Z",
"dateReserved": "2026-10-18T13:46:46.184Z",
"dateUpdated": "2026-10-19T16:36:42.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93348 (GCVE-0-2026-93348)
Vulnerability from nvd – Published: 2026-09-28 15:09 – Updated: 2026-09-30 14:43 X_Open Source
VLAI
EPSS
VEX
Title
Unsloth Zoo Code Injection via model_type in config.json
Summary
Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:42 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/unslothai/unsloth-zoo/pull/1083 | patchissue-tracking |
| https://github.com/unslothai/unsloth-zoo/pull/1108 | patchissue-tracking |
| https://github.com/unslothai/unsloth/commit/92ee0… | patch |
| https://www.vulncheck.com/advisories/unsloth-zoo-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| unslothai | unsloth-zoo |
Affected:
2025.9.9 , < 2026.8.14
(date)
|
|
| unslothai | unsloth |
Affected:
2025.9.9 , < 2026.8.20
(date)
|
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:42:53.294398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:43:10.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/unslothai/unsloth-zoo",
"product": "unsloth-zoo",
"repo": "https://github.com/unslothai/unsloth-zoo",
"vendor": "unslothai",
"versions": [
{
"lessThan": "2026.8.14",
"status": "affected",
"version": "2025.9.9",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/unslothai/unsloth",
"product": "unsloth",
"repo": "https://github.com/unslothai/unsloth",
"vendor": "unslothai",
"versions": [
{
"lessThan": "2026.8.20",
"status": "affected",
"version": "2025.9.9",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ariel Fogel (afogel) of Pillar Security"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model\u0027s config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:09:41.524Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request (1)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth-zoo/pull/1083"
},
{
"name": "Pull Request (2)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth-zoo/pull/1108"
},
{
"name": "Unsloth Zoo Dependency Bump",
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/commit/92ee0207a38ebc8af1a0e678aa92d7e7d901ea0d"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/unsloth-zoo-code-injection-via-model-type-in-config-json"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Unsloth Zoo Code Injection via model_type in config.json",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93348",
"datePublished": "2026-09-28T15:09:41.524Z",
"dateReserved": "2026-09-17T18:41:40.757Z",
"dateUpdated": "2026-09-30T14:43:10.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112075 (GCVE-0-2026-112075)
Vulnerability from cvelistv5 – Published: 2026-10-19 03:45 – Updated: 2026-10-19 16:36 X_Open Source
VLAI
EPSS
VEX
Title
unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
Summary
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421754 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421754/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112075 | third-party-advisory |
| https://vuldb.com/submit/1009576 | third-party-advisory |
| https://github.com/unslothai/unsloth/issues/12419 | issue-tracking |
| https://github.com/unslothai/unsloth/pull/11560 | issue-trackingpatch |
| https://github.com/user-attachments/files/3290831… | exploit |
| https://github.com/unslothai/unsloth/commit/de801… | patch |
| https://github.com/unslothai/unsloth/releases/tag… | patch |
| https://github.com/unslothai/unsloth/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112075",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:35.739324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:42.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:unslothai:unsloth:*:*:*:*:*:*:*:*"
],
"product": "unsloth",
"vendor": "unslothai",
"versions": [
{
"status": "affected",
"version": "0.1.501-beta"
},
{
"status": "unaffected",
"version": "0.1.902-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck99 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "Use of Externally-Controlled Input to Select Classes or Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T03:45:20.785Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421754 | unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421754"
},
{
"name": "VDB-421754 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421754/cti"
},
{
"name": "CVE-2026-112075 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112075"
},
{
"name": "Submit #1009576 | Unsloth AI Unsloth up to 2026.9.11 (commit de801746386a53a0cb26216e715a0af863b76ad9) Unsafe Reflection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009576"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth/issues/12419"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/unslothai/unsloth/pull/11560"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32908312/poc.zip"
},
{
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/unslothai/unsloth/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T15:51:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112075",
"datePublished": "2026-10-19T03:45:20.785Z",
"dateReserved": "2026-10-18T13:46:46.184Z",
"dateUpdated": "2026-10-19T16:36:42.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93348 (GCVE-0-2026-93348)
Vulnerability from cvelistv5 – Published: 2026-09-28 15:09 – Updated: 2026-09-30 14:43 X_Open Source
VLAI
EPSS
VEX
Title
Unsloth Zoo Code Injection via model_type in config.json
Summary
Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:42 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/unslothai/unsloth-zoo/pull/1083 | patchissue-tracking |
| https://github.com/unslothai/unsloth-zoo/pull/1108 | patchissue-tracking |
| https://github.com/unslothai/unsloth/commit/92ee0… | patch |
| https://www.vulncheck.com/advisories/unsloth-zoo-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| unslothai | unsloth-zoo |
Affected:
2025.9.9 , < 2026.8.14
(date)
|
|
| unslothai | unsloth |
Affected:
2025.9.9 , < 2026.8.20
(date)
|
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:42:53.294398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:43:10.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/unslothai/unsloth-zoo",
"product": "unsloth-zoo",
"repo": "https://github.com/unslothai/unsloth-zoo",
"vendor": "unslothai",
"versions": [
{
"lessThan": "2026.8.14",
"status": "affected",
"version": "2025.9.9",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/unslothai/unsloth",
"product": "unsloth",
"repo": "https://github.com/unslothai/unsloth",
"vendor": "unslothai",
"versions": [
{
"lessThan": "2026.8.20",
"status": "affected",
"version": "2025.9.9",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ariel Fogel (afogel) of Pillar Security"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model\u0027s config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:09:41.524Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request (1)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth-zoo/pull/1083"
},
{
"name": "Pull Request (2)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/unslothai/unsloth-zoo/pull/1108"
},
{
"name": "Unsloth Zoo Dependency Bump",
"tags": [
"patch"
],
"url": "https://github.com/unslothai/unsloth/commit/92ee0207a38ebc8af1a0e678aa92d7e7d901ea0d"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/unsloth-zoo-code-injection-via-model-type-in-config-json"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Unsloth Zoo Code Injection via model_type in config.json",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93348",
"datePublished": "2026-09-28T15:09:41.524Z",
"dateReserved": "2026-09-17T18:41:40.757Z",
"dateUpdated": "2026-09-30T14:43:10.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}