Submit #1009576: Unsloth AI Unsloth up to 2026.9.11 (commit de801746386a53a0cb26216e715a0af863b76ad9) Unsafe Reflection

A vulnerability was found in Unsloth AI Unsloth up to 2026.9.11 (commit de801746386a53a0cb26216e715a0af863b76ad9) and classified as high 8.8. Affected is the FastSentenceTransformer modules.json handling in unsloth/models/sentence_transformer.py. The manipulation of the argument type (the modules.json class reference of a model directory) leads to unsafe reflection (CWE-470). It is possible to launch the attack remotely. User interaction is required because the victim must open the crafted model directory for embedding training.

Technical Details
- Affected file/function: unsloth/models/sentence_transformer.py / FastSentenceTransformer._is_transformer_module_ref (line 1206) and FastSentenceTransformer._load_modules (lines 1242, 1275, 1277), called from FastSentenceTransformer.from_pretrained (line 1836)
- Vulnerable parameter: modules.json "type" class-reference string of the model directory
- Attack vector: Network
- Privileges required: None
- Trigger condition: the product resolves the model-supplied string with sentence_transformers.util.import_from_string, importing the named module in the Unsloth process (its import-time code executes) and then calling .load() on the imported object; the string may resolve against any module already installed in the victim environment, so no Python sidecar file is required inside the model directory. The scan bypasses the trust gate that sentence-transformers 6.x applies to the same input (which requires trust_remote_code for classes outside the sentence_transformers.* namespace).

Impact
- Confidentiality: High (import-time code of attacker-chosen installed modules runs with product process privileges)
- Integrity: High (same code execution surface)
- Availability: High (same code execution surface)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-30
- Vendor notified: 2026-10-01 (upstream issue text prepared; submission pending)
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Treat modules.json "type" values as untrusted data: resolve them only through sentence-transformers' gated _load_module_class (honoring trust_remote_code as stock sentence-transformers does) or against an allowlist of shipped sentence_transformers.* module classes; never call sentence_transformers.util.import_from_string directly on model-supplied strings.

• Source: ⚠️ https://github.com/unslothai/unsloth/issues/12419
• User: r1ck99 (UID 100733)
• Submission: 10/01/2026 12:42 (28 days ago)
• Moderation: 10/18/2026 15:46 (17 days later)
• Status: Accepted
• VulDB entry: 421754 [unslothai unsloth up to 0.1.501-beta sentence_transformer.py type externally-controlled input to select classes or code]
• Points: 20