Trusting Unsloth’s trust setting could mean executing malicious code

Publisher excerpt From CSO Online

AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed a high-severity vulnerability in Unsloth’s model loader that could allow arbitrary Python code execution when processing a maliciously crafted model configuration. Tracked as CVE-2026-93348, the vulnerability carries a CVSS score of 8.6. Setting trust_remote_code=False does not prevent exploitation because the vulnerable code path does not rely on Hugging Face’s remote-code mechanism. The problem lies in how Unsloth identifies model architectures. It takes a model-type value from a model’s configuration and uses it to construct a Python import statement. Because the value was not sufficiently validated, an attacker could inject additional Python statements into that import and have them executed through Python’s exec() function. The impact goes beyond model loading. Pillar said the injected code executes with the permissions of the loading process, potentially exposing proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Its testing showed that execution could occur before model weights or tokenizers were loaded. Unsloth Zoo versions from 2025.9.9 to before 2026.8.14 are affected, as are Unsloth versions from 2025.9.9 to before 2026.8.20. The initial fix reportedly landed within six hours of Pillar’s August 22 private report, but the researchers said the maintainers did not respond to subsequent disclosure attemp…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.