Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution

Security researcher Ariel Fogel of Pillar Security disclosed a vulnerability in Unsloth Studio, the web interface for the popular Unsloth library used to fine-tune and quantize LLMs, that let a malicious model repository run arbitrary Python code merely by having its configuration inspected. The root cause was Unsloth Studio's use of the trust_remote_code=True setting in Hugging Face Transformers, which let custom code referenced in a model's config.json execute before the model weights were ever loaded or any inference was run. An attacker exploiting this could run code with the victim's privileges, potentially stealing training data, model artifacts, cloud credentials, or SSH keys from development environments. Pillar reported the issue in early June and Unsloth shipped a fix in version 2026.6.9, though the two sides disagreed on severity and no CVE was ultimately assigned; Pillar says it has seen no in-the-wild exploitation but notes similar trust_remote_code issues have affected other AI tools this year, including LMDeploy (CVE-2026-46432), vLLM (CVE-2026-4944), and InstructLab (CVE-2026-6859).