CVE-2026-93348

Unsloth Zoo, as used by Unsloth, has a code-injection flaw in the model-loading compile path. get_transformers_model_type() in hf_utils.py copies model_type strings from nested model configurations without a character allowlist, so a newline and extra Python in a malicious config.json can survive normalization, close the generated import, and run through exec() in unsloth_compile_transformers(). An attacker who supplies that model gains remote code execution as the user who loads it for training or inference; the victim must load the model (CVSS 4.0 8.6, user interaction passive). Affected builds are Unsloth Zoo 2025.9.9 before 2026.8.14 and Unsloth 2025.9.9 through 2026.8.19. It is not on the CISA KEV list and no public proof-of-concept is known.

What to do: Upgrade Unsloth Zoo to 2026.8.14 or later and Unsloth to a release newer than 2026.8.19. Until then, load models only from trusted sources and treat config.json model_type values, including nested ones, as untrusted input. Review hosts that trained or inferred with affected builds for unexpected code execution under the loading user.