CVE-2026-93348
CVSS 8.1 HIGH: unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code… EPSS 0.4% (35th percentile).
Vulnerabilities · 19h ago
Pillar Security disclosed CVE-2026-93348, a flaw that lets crafted model configurations execute Python through Unsloth Zoo versions before 2026.8.14 and Unsloth versions before 2026.8.20. Disabling Hugging Face’s trust_remote_code setting does not block it.
Unsloth reads a model-type label from the configuration and uses it in a Python import command. Because the label was not tightly checked, a crafted value can add instructions for Python to run. Pillar’s testing found execution can happen before model weights or tokenizers load, with the permissions of the loading process—potentially reaching datasets, model artifacts, Hugging Face tokens, and cloud credentials.
For teams loading third-party configurations in notebooks or training workers, the trust boundary is the whole loader process, not just Hugging Face’s remote-code setting. Updating a package cannot establish whether an earlier load exposed data or credentials.
CVSS 8.1 HIGH: unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code… EPSS 0.4% (35th percentile).
1 source covering this story
Trusting Unsloth’s trust setting could mean executing malicious code
A high-severity flaw could expose AI training data, model artifacts, and cloud credentials when a crafted model configuration is loaded.
Part of the PlainSec briefing for 2026-10-29