Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models
Unsloth patched Studio 2026.6.9 after default remote-code trust let malicious Hugging Face models execute Python on inspection.
Unsloth patched an arbitrary code execution flaw in its Studio web interface, fixed in version 2026.6.9. Researcher Ariel Fogel of Pillar Security found that the backend set trust_remote_code=True by default while inspecting a selected Hugging Face model, so a crafted config.json auto_map could import attacker-controlled Python without downloading weights, starting inference, or asking the user. The code ran with the Studio process privileges and could expose Hugging Face tokens, cloud credentials, SSH keys, datasets, and model artifacts, including on local deployments. Independent testing confirmed the inspection path was closed; no CVE was assigned.