CVE-2026-112075

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer.istransformermoduleref of the file unsloth/models/sentencetransformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or...

CVE-2026-112075

A flaw was found in unsloth. The sentence transformer module improperly validates user-controlled input when resolving class references. A remote attacker could exploit this vulnerability by enticing a user to process specially crafted input, potentially leading to arbitrary code execution and...

CVE-2026-112075

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer.istransformermoduleref of the file unsloth/models/sentencetransformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or...

EUVD-2026-104057

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer.istransformermoduleref of the file unsloth/models/sentencetransformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or...

CVE-2026-112075 unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer.istransformermoduleref of the file unsloth/models/sentencetransformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or...

CVE-2026-112075

A vulnerability exists in unslothai unsloth up to version 0.1.501-beta within the unsloth/models/sentence_transformer.py file. The issue resides in the FastSentenceTransformer._is_transformer_module_ref function, where manipulation of the Type argument allows for the use of externally-controlled ...

PT-2026-117219

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer. is transformer module ref of the file unsloth/models/sentence transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select class...

fatcat-gpt (>=0.1.1, <=0.2.0), nle-framework-pappppx (0.1.0) potentially affected by unknown CVE via unsloth (>=2026.4.6, <=2026.5.8)

unsloth PYPI version =2026.4.6, =0.1.1, =0.2.0 - nle-framework-pappppx 0.1.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0075...

CVE-2026-93348

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348

A flaw was found in Unsloth Zoo, which can lead to arbitrary code execution when loading a machine learning model. The vulnerability exists due to improper input sanitization of the model type parameter within configuration files during compilation. An attacker can exploit this issue by supplying...

CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348

The Unsloth Zoo library (versions 2025.9.9 before 2026.8.14), as implemented in Unsloth (2025.9.9 through 2026.8.19), is vulnerable to a code injection flaw in the model-loading compile path. The root cause is that the get_transformers_model_type() function in hf_utils.py collects model_type valu...

CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

EUVD-2026-88318

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

CVE-2026-93348 Unsloth Zoo Code Injection via model_type in config.json

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

PT-2026-99916

Name of the Vulnerable Software and Affected Versions Unsloth Zoo versions 2025.9.9 through 2026.8.13 Unsloth versions 2025.9.9 through 2026.8.19 Description A code injection issue exists in the model-loading compile path. The get transformers model type function in hf utils.py collects model typ...

CVE-2026-93348: Improper Control of Generation of Code

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the gettransformersmodeltype function in hfutils.py collects modeltype values from nested model configurations...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-9856 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-9856 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

unsloth (>=2025.11.2, <=2025.11.6), unsloth-zoo (>=2025.11.3, <=2025.12.1) potentially affected by CVE-2026-5241 via transformers (4.57.2)

transformers PYPI version 4.57.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - unsloth =2025.11.2, =2025.11.3, =2025.12.1 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...