CyberRota Analysis
AI-GeneratedUnsloth Zoo versions prior to 2026.8.14 are vulnerable to a code injection flaw that allows attackers to embed malicious Python code in nested model configurations, leading to remote code execution when models are loaded for training or inference. This vulnerability poses a significant risk to users who utilize these versions for machine learning tasks, as it can compromise system integrity and data security. Organizations leveraging Unsloth Zoo for model management should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.