CVE-2026-93348

Unsloth is a tool used to train and run AI language models. This bug is like a booby-trapped instruction manual: a model's setup file (config.json) can contain a hidden command that the tool runs without checking it first, letting an attacker's 'model' secretly take control of the computer loading it. The trap only springs if someone loads a model file that was tampered with.

This matters to you if your team uses Unsloth or Unsloth Zoo to train or run AI models, especially if you download or use models created by other people or organizations. This is only a risk if someone actually loads a malicious model file — simply having the software installed is not enough, but loading an untrusted model does require no special login or permissions beyond normal use.

There is no evidence yet of attackers exploiting this in the real world, and no public exploit code exists, so this is not an active emergency — but the flaw is serious (it can fully compromise the machine loading a bad model) and has drawn sustained media attention, so it deserves a planned update soon rather than being ignored.

1. Inventory all systems running unsloth or unsloth-zoo and record exact versions in use. 2. Confirm exposure by checking whether any workflow loads model_type configs from third-party or public sources (e.g., Hugging Face Hub) rather than exclusively internally vetted models. 3. Upgrade unsloth-zoo to >=2026.8.14 and unsloth to >=2026.8.20; these versions add a character allowlist to get_transformers_model_type() in hf_utils.py, preventing newline injection into the generated import/exec statement in unsloth_compile_transformers(). 4. Review release notes for either package for breaking changes to the model-loading compile path before upgrading in production pipelines. 5. If immediate patching isn't possible, implement a temporary workaround: restrict model loading to a vetted allowlist of trusted model repos/hashes, and run training/inference in a sandboxed or least-privilege environment to limit blast radius of any exec()-based injection. 6. No CISA KEV listing exists, so there is no federal remediation deadline; monitor vendor advisories and the unsloth/unsloth-zoo changelogs for any shift to active exploitation status.

CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact via network-reachable code injection requiring user interaction (loading the malicious model). Weakness class is CWE-94 (Code Injection), triggered by unsanitized model_type strings in nested HuggingFace config.json files reaching an exec() call during unsloth_compile_transformers(). EPSS places predicted exploitation likelihood in the lower-middle percentile with a flat trend, consistent with no observed in-the-wild activity, no KEV listing, and no public PoC. Exploit maturity is theoretical/reported-only at this time; sustained press coverage reflects interest in the AI-supply-chain angle rather than confirmed attacks.