Unsloth Model Loader Flaw Runs Attacker Code Even With Remote Code Trust Disabled
A high-severity flaw in Unsloth's model loader, tracked as CVE-2026-93348 and carrying a CVSS score of 8.6, permits arbitrary Python code execution when a maliciously crafted model configuration is processed. What makes it awkward for AI teams is that the usual safeguard offers no cover: setting trust_remote_code=False does not prevent exploitation, because the vulnerable code path never relies on Hugging Face's remote-code mechanism at all. Unsloth Zoo releases from 2025.9.9 up to but not including 2026.8.14 are affected, as are Unsloth releases from 2025.9.9 up to but not including 2026.8.20. Any group fine-tuning or serving models with these libraries in notebooks, training workers or container images sits inside the exposure window. Fixed releases exist for both packages.
The weakness sits in how the library identifies model architectures. It takes a model-type value from the model's configuration and uses that value to construct a Python import statement, which is then passed through Python's exec() function. Because the value was not sufficiently validated, an attacker able to publish or tamper with a model configuration can inject additional Python statements into the constructed import and have them executed by the loading process. Testing showed that execution could occur before model weights or tokenizers were loaded, meaning the payload fires at the earliest stage of the pipeline. The injected code runs with the permissions of the loading process.
Those permissions are rarely modest. A machine learning training host typically holds proprietary datasets, model artifacts, Hugging Face tokens and cloud credentials, all of which fall within reach of code executing in that context. The delivery path is low friction as well, since a poisoned configuration on a public model hub reaches victims who believe a trust flag is protecting them. On current exploitation status, FIRST EPSS puts the probability of exploitation in the next 30 days at 0.4 percent, and no in-the-wild activity has been reported. An initial fix reportedly landed within six hours of the private report made on 22 August, although subsequent disclosure attempts reportedly went unanswered and the CVE was ultimately assigned with third-party assistance.
Attack Surface
Supply Chain (Third-party vendors), Endpoint, Cloud Service
Tactics
Execution, Initial Access, Credential Access
Techniques
- T1059.006 – Command and Scripting Interpreter: Python
- T1195.002 – Supply Chain Compromise: Compromise Software Supply Chain
- T1552.001 – Unsecured Credentials: Credentials In Files
- T1528 – Steal Application Access Token
SuperPRO's Threat Countermeasures Procedures
- Upgrade Unsloth Zoo to 2026.8.14 or later and Unsloth to 2026.8.20 or later, which address CVE-2026-93348; releases from 2025.9.9 up to those versions are vulnerable.
- Inventory dependencies across AI notebooks, training workers and container images with 'pip show unsloth unsloth_zoo' and grep requirements.txt, poetry.lock and Dockerfiles for unsloth or unsloth_zoo pins inside the affected 2025.9.9 range.
- Stop treating trust_remote_code=False as a mitigating control for this flaw, since the vulnerable import construction does not use Hugging Face's remote-code mechanism; document the setting as non-protective in internal model-loading standards.
- Where the fixed releases are not yet deployed, block loading of externally sourced model configurations on hosts still running unsloth_zoo below 2026.8.14 or unsloth below 2026.8.20, and limit fine-tuning jobs on those hosts to model repositories already held internally.
- Run Unsloth loading and fine-tuning jobs in disposable containers under a dedicated low-privilege service account, with no long-lived HF_TOKEN, AWS_ACCESS_KEY_ID or GOOGLE_APPLICATION_CREDENTIALS values present in the process environment.
- Alert in EDR on python processes that spawn sh, bash, curl, wget or base64 children, or that make outbound connections to non-allowlisted hosts, during model-loading phases on training infrastructure.
- Rotate Hugging Face access tokens, cloud credentials and registry keys exposed to any host that ran an affected Unsloth or Unsloth Zoo version while loading externally sourced models, and restrict model pulls to an internal mirror of vetted repositories.
