CVE-2026-93348

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348

A flaw was found in Unsloth Zoo, which can lead to arbitrary code execution when loading a machine learning model. The vulnerability exists due to improper input sanitization of the model type parameter within configuration files during compilation. An attacker can exploit this issue by supplying...

CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348

The Unsloth Zoo library (versions 2025.9.9 before 2026.8.14), as implemented in Unsloth (2025.9.9 through 2026.8.19), is vulnerable to a code injection flaw in the model-loading compile path. The root cause is that the get_transformers_model_type() function in hf_utils.py collects model_type valu...

CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

EUVD-2026-88318

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348: Improper Control of Generation of Code

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

PT-2026-99916

Name of the Vulnerable Software and Affected Versions Unsloth Zoo versions 2025.9.9 through 2026.8.13 Unsloth versions 2025.9.9 through 2026.8.19 Description A code injection issue exists in the model-loading compile path. The get transformers model type function in hf utils.py collects model typ...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-9856 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-5241 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-4372 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-4372 Source advisory: OSV:PYSEC-2026-2289...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-1839 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-1839 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-1839 Source advisory: OSV:PYSEC-2026-2288...