unslothai unsloth zoo/unsloth up to 2026.8.13 Model Loading hf_utils.py get_transformers_model_type code injection

Summaryinfo

A vulnerability was found in unslothai unsloth zoo and unsloth up to 2026.8.13. It has been rated as critical. This affects the function get_transformers_model_type of the file hf_utils.py of the component Model Loading. The manipulation leads to code injection. This vulnerability is traded as CVE-2026-93348. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in unslothai unsloth zoo and unsloth up to 2026.8.13 and classified as critical. This issue affects the function get_transformers_model_type of the file hf_utils.py of the component Model Loading. The manipulation with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-93348 since 09/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/28/2026). MITRE ATT&CK project uses the attack technique T1059 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• unslothai

Name

• unsloth
• unsloth zoo

Version

• 2026.8.0
• 2026.8.1
• 2026.8.2
• 2026.8.3
• 2026.8.4
• 2026.8.5
• 2026.8.6
• 2026.8.7
• 2026.8.8
• 2026.8.9
• 2026.8.10
• 2026.8.11
• 2026.8.12
• 2026.8.13

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion