Trusting Unsloth’s trust setting could mean executing malicious code

Pillar Security disclosed CVE-2026-93348, a high-severity vulnerability with a CVSS score of 8.6 in Unsloth's model loader that allows arbitrary Python code execution when processing a maliciously crafted model configuration, even with trust_remote_code=False set. The flaw stems from Unsloth taking a model-type value from a model's configuration and using it to construct a Python import statement without sufficient validation, letting an attacker inject statements executed through Python's exec() function with the loading process's permissions, potentially exposing proprietary datasets, model artifacts, Hugging Face tokens and cloud credentials. Unsloth Zoo versions from 2025.9.9 to before 2026.8.14 and Unsloth versions from 2025.9.9 to before 2026.8.20 are affected; Pillar said the initial fix landed within six hours of its August 22 private report, and updating to Unsloth Zoo 2026.8.14 or later and Unsloth 2026.8.20 or later addresses the vulnerability.

AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed https://www.pillar.security/blog/trust-disabled-code-executed-arbitrary-code-execution-in-unsloths-model-loader a high-severity vulnerability in Unsloth’s model loader that could allow arbitrary Python code execution when processing a maliciously crafted model configuration. Tracked as CVE-2026-93348 https://nvd.nist.gov/vuln/detail/cve-2026-93348 , the vulnerability carries a CVSS score of 8.6. Setting trust remote code=False https://www.csoonline.com/article/4181094/hugging-face-transformers-rce-flaw-enables-stealthy-compromise-via-ai-model-configs.html :~:text=trust remote code=false does not prevent exploitation because the vulnerable code path does not rely on Hugging Face’s remote-code mechanism. The problem lies in how Unsloth identifies model architectures. It takes a model-type value from a model’s configuration and uses it to construct a Python import statement. Because the value was not sufficiently validated, an attacker could inject additional Python statements into that import and have them executed through Python’s exec function. The impact goes beyond model loading https://www.csoonline.com/article/4228910/unsloths-model-picker-had-a-code-execution-problem-2.html . Pillar said the injected code executes with the permissions of the loading process, potentially exposing proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Its testing showed that execution could occur before model weights or tokenizers were loaded. Unsloth Zoo versions from 2025.9.9 to before 2026.8.14 are affected, as are Unsloth versions from 2025.9.9 to before 2026.8.20. The initial fix reportedly landed within six hours of Pillar’s August 22 private report, but the researchers said the maintainers did not respond to subsequent disclosure attempts. A CVE was ultimately assigned with VulnCheck’s assistance. For security teams, the immediate task is to check dependencies in AI notebooks, training workers, and container images. Updating Unsloth Zoo to 2026.8.14 or later, and Unsloth to 2026.8.20 or later, addresses the reported vulnerability.