AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed a high-severity vulnerability in Unsloth’s model that could allow arbitrary Python code execution when processing a maliciously crafted model configuration.
Tracked as CVE-2026-93348, the vulnerability carries a CVSS score of 8.6. Setting trust_remote_code=False does not prevent exploitation because the vulnerable code path does not rely on Hugging Face’s remote-code mechanism.
The problem lies in how Unsloth identifies model architectures. It takes a model-type value from a model’s configuration and uses it to construct a Python import statement. Because the value was not sufficiently validated, an attacker could inject additional Python statements into that import and have them executed through Python’s exec() function.
The impact goes beyond model . Pillar said the injected code executes with the permissions of the process, potentially exposing proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Its testing showed that execution could occur before model weights or tokenizers were loaded.
Unsloth Zoo versions from 2025.9.9 to before 2026.8.14 are affected, as are Unsloth versions from 2025.9.9 to before 2026.8.20. The initial fix reportedly landed within six hours of Pillar’s August 22 private report, but the researchers said the maintainers did not respond to subsequent disclosure attempts.
A CVE was ultimately assigned with VulnCheck’s assistance. For security teams, the immediate task is to check dependencies in AI notebooks, training workers, and container images. Updating Unsloth Zoo to 2026.8.14 or later, and Unsloth to 2026.8.20 or later, addresses the reported vulnerability.