CVE-2026-93348

Unsloth model configuration can execute Python despite disabled remote code

UnslothAI · Unsloth Zoo model-loading compiler

First documented disclosure · Review checkpoint

Summary

A crafted model configuration can execute Python during training or inference loading.

Severity and exploitation evidence

High · 8.6/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A nested model_type value reaches generated import source and exec without a strict identifier allowlist.

Conditions required

An affected loading path processes an attacker-controlled configuration; trust_remote_code=False does not protect this separate path.

Potential impact

Execution with the loading process’s access to datasets, tokens and outputs.

Affected versions and configurations

unsloth-zoo >=2025.9.9, <2026.8.14; unsloth >=2025.9.9, <2026.8.20 may resolve vulnerable Zoo versions.

Fix and mitigation status

Zoo 2026.8.14 fixes this issue; Unsloth 2026.8.20 raises the dependency floor to a fixed Zoo release.

Practical next steps

Inspect both installed packages, update dependencies and rebuild notebooks/images. Older Unsloth with a fixed Zoo can be protected; constrain loading-process privileges.

Operating lesson

A remote-code flag protects only paths that actually enforce it.

Evidence and limits

The public patch PR dates to August 23; private reporting August 22 is not public disclosure. The CVE was published September 28 and Pillar’s research October 27. Date-like package versions are identifiers, not verified shipping dates. This differs from Unsloth Studio model inspection.

Sources