Unsloth loader can run Python even with trust disabled
Original title: Trusting Unsloth’s trust setting could mean executing malicious code
CVE-2026-93348, scored 8.6, is fixed in Unsloth 2026.8.20 and Unsloth Zoo 2026.8.14.
Pillar Security disclosed CVE-2026-93348, a high-severity flaw in Unsloth’s model loader. A model-type value from a configuration is placed into a Python import and executed with exec(), so trust_remote_code=False does not stop it. Injected code runs as the loading process and can expose datasets, artifacts, Hugging Face tokens, and cloud credentials. Unsloth Zoo before 2026.8.14 and Unsloth before 2026.8.20 are affected.
Unconfirmed: No in-the-wild exploitation is reported, and later maintainer responses are only described by the researchers.
- CVSS score is 8.6.
- Pillar’s testing saw code run before weights or tokenizers loaded.
- The first fix reportedly landed within six hours of an August 22 private report.
- Pillar says maintainers did not answer later disclosure attempts.
- VulnCheck assisted with CVE assignment.
Impact: Arbitrary Python execution as the model-loading process
| Product | Affected | Fixed in |
|---|---|---|
| Unsloth Zoo | 2025.9.9 to before 2026.8.14 | 2026.8.14 or later |
| Unsloth | 2025.9.9 to before 2026.8.20 | 2026.8.20 or later |
- 1.Update Unsloth Zoo to 2026.8.14 or later and Unsloth to 2026.8.20 or later.
- 2.Check Unsloth dependencies in notebooks, training workers, and container images.
- CVEs
- CVE-2026-93348
- ATT&CK
- T1059.006 Python
- Vendors
- Unsloth
- Products
- Unsloth Zoo
- Organizations
- Pillar SecurityVulnCheck
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93348 | Code injection RCE in Unsloth model loading | 8.6 | — |
From the original article
1 min read at csoonline.com
AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed a high-severity vulnerability in Unsloth’s model loader that could allow arbitrary Python code execution when processing a maliciously crafted model configuration. Tracked as CVE-2026-93348, the vulnerability carries a CVSS score of 8.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.