unslothai unsloth up to 0.1.501-beta sentence_transformer.py type externally-controlled input to select classes or code

Summaryinfo

A vulnerability was found in unslothai unsloth up to 0.1.501-beta and classified as critical. This vulnerability affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. Such manipulation of the argument Type leads to use of externally-controlled input to select classes or code. This vulnerability is traded as CVE-2026-112075. The attack may be launched remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in unslothai unsloth up to 0.1.501-beta and classified as critical. Affected by this issue is the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. The manipulation of the argument type with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. Using CWE to declare the problem leads to CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. Impacted is confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-112075. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept.

Upgrading to version 0.1.902-beta eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch de801746386a53a0cb26216e715a0af863b76ad9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• unslothai

Name

• unsloth

Version

• 0.1.501-beta

License

• open-source

Website

• Product: https://github.com/unslothai/unsloth/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1009576: Unsloth AI Unsloth up to 2026.9.11 (commit de801746386a53a0cb26216e715a0af863b76ad9) Unsafe Reflection (by r1ck99)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion