Unsloth Studio (Product): news timeline & CVEs

What Happens When a Trusted Model Repo Changes? Unsloth Studio Re-Checks Before It Runs

Unsloth Studio re-checks model code, weights, packages, and tools before running a changed trusted repo.

Unsloth’s October 6 security overview explains how Studio re-checks artifacts before anything runs when a trusted model repository changes. Custom model code is scanned and approval is bound to its fingerprint. Flagged weight files are blocked in the load path, package-content findings fail CI, and tools execute in probed OS sandboxes. The write-up also describes the limits of each checkpoint.

MarkTechPostOct 8, 01:49 UTC · 14d agoAI safety & security3

Unsloth’s model picker had a code-execution problem

Unsloth Studio executed remote Python when users merely selected a model, letting crafted repos run code on developer machines.

Pillar Security found that Unsloth Studio enabled Hugging Face Transformers' trust_remote_code during a routine model check, so reading config.json could download and execute arbitrary Python. The code ran with the user's privileges and could expose training data, model artifacts, Hugging Face tokens, SSH keys, or cloud credentials. Unsloth fixed this in version 2026.6.9 by stopping direct arbitrary Hugging Face loading in Studio and not trusting remote code from local model files, but declined a CVE because Studio was called beta. Pillar says the vulnerable code shipped in the generally available unsloth PyPI package and that its proof of concept was not caught by Hugging Face scanning.

CSO OnlineSep 30, 13:56 UTC · 22d agoVulnerability2

Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models

Unsloth patched Studio 2026.6.9 after default remote-code trust let malicious Hugging Face models execute Python on inspection.

Unsloth patched an arbitrary code execution flaw in its Studio web interface, fixed in version 2026.6.9. Researcher Ariel Fogel of Pillar Security found that the backend set trust_remote_code=True by default while inspecting a selected Hugging Face model, so a crafted config.json auto_map could import attacker-controlled Python without downloading weights, starting inference, or asking the user. The code ran with the Studio process privileges and could expose Hugging Face tokens, cloud credentials, SSH keys, datasets, and model artifacts, including on local deployments. Independent testing confirmed the inspection path was closed; no CVE was assigned.

GBHackersSep 30, 06:22 UTC · 22d agoVulnerability3· 2 reads

Unsloth Studio

Timeline3 articles

Appears with

What Happens When a Trusted Model Repo Changes? Unsloth Studio Re-Checks Before It Runs

Unsloth’s model picker had a code-execution problem

Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models