{"id":10189,"date":"2026-10-28T11:53:22","date_gmt":"2026-10-28T11:53:22","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10189"},"modified":"2026-10-28T11:53:22","modified_gmt":"2026-10-28T11:53:22","slug":"trusting-unsloths-trust-setting-could-mean-executing-malicious-code","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10189","title":{"rendered":"Trusting Unsloth\u2019s trust setting could mean executing malicious code"},"content":{"rendered":"<div>\n<div class=\"grid grid--cols-10@md grid--cols-8@lg article-column \">\n<div class=\"col-12 col-10@md col-6@lg col-start-3@lg\">\n<div class=\"article-column__content\">\n<div class=\"container\"><\/div>\n<p class=\"wp-block-paragraph\">AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has <a href=\"https:\/\/www.pillar.security\/blog\/trust-disabled-code-executed-arbitrary-code-execution-in-unsloths-model-loader\" target=\"_blank\" rel=\"noopener\">disclosed<\/a> a high-severity vulnerability in Unsloth\u2019s model loader that could allow arbitrary Python code execution when processing a maliciously crafted model configuration.<\/p>\n<p class=\"wp-block-paragraph\">Tracked as <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-93348\" target=\"_blank\" rel=\"noopener\">CVE-2026-93348<\/a>, the vulnerability carries a CVSS score of 8.6. Setting <a href=\"https:\/\/www.csoonline.com\/article\/4181094\/hugging-face-transformers-rce-flaw-enables-stealthy-compromise-via-ai-model-configs.html#:~:text=trust_remote_code=false\">trust_remote_code=False<\/a> does not prevent exploitation because the vulnerable code path does not rely on Hugging Face\u2019s remote-code mechanism.<\/p>\n<p class=\"wp-block-paragraph\">The problem lies in how Unsloth identifies model architectures. It takes a model-type value from a model\u2019s configuration and uses it to construct a Python import statement. Because the value was not sufficiently validated, an attacker could inject additional Python statements into that import and have them executed through Python\u2019s exec() function.<\/p>\n<p class=\"wp-block-paragraph\">The impact goes beyond <a href=\"https:\/\/www.csoonline.com\/article\/4228910\/unsloths-model-picker-had-a-code-execution-problem-2.html\">model loading<\/a>. Pillar said the injected code executes with the permissions of the loading process, potentially exposing proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Its testing showed that execution could occur before model weights or tokenizers were loaded.<\/p>\n<p class=\"wp-block-paragraph\">Unsloth Zoo versions from 2025.9.9 to before 2026.8.14 are affected, as are Unsloth versions from 2025.9.9 to before 2026.8.20. The initial fix reportedly landed within six hours of Pillar\u2019s August 22 private report, but the researchers said the maintainers did not respond to subsequent disclosure attempts.<\/p>\n<p class=\"wp-block-paragraph\">A CVE was ultimately assigned with VulnCheck\u2019s assistance. For security teams, the immediate task is to check dependencies in AI notebooks, training workers, and container images. Updating Unsloth Zoo to 2026.8.14 or later, and Unsloth to 2026.8.20 or later, addresses the reported vulnerability.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed a high-severity vulnerability in Unsloth\u2019s model loader that could allow arbitrary Python code execution when processing a maliciously crafted model configuration. Tracked as CVE-2026-93348, the vulnerability carries a CVSS score of 8.6. Setting trust_remote_code=False does not [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":10190,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10189"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10189"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10190"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}