Read the docs
TI-2026-62938 Aliases CVE-2026-93348GHSA-6crx-pj66-wf6h

Unsloth Zoo Code Injection via model_type in config.json

Priority LOW 39CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-94.

Summary

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Partial unsloth-zoo (unslothai): 2026.8.14unsloth (unslothai): 2026.8.20Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
unslothaiunsloth-zoo2025.9.9 to before 2026.8.142026.8.14Patch availableCNA
unslothaiunsloth2025.9.9 to before 2026.8.202026.8.20Patch availableCNA
  • unsloth-zoo Vendorunslothai Affected 2025.9.9 to before 2026.8.14 Fixed in 2026.8.14 Patch available CNA
  • unsloth Vendorunslothai Affected 2025.9.9 to before 2026.8.20 Fixed in 2026.8.20 Patch available CNA

Remediation

  • Fix · CNA unsloth-zoo (unslothai) Fixed in 2026.8.14
  • Fix · CNA unsloth (unslothai) Fixed in 2026.8.20

Red Hat 1 advisory

  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Not affected: 2 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93348
  2. 2026-10-03 Alias added: GHSA-6crx-pj66-wf6h
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  5. 2026-10-22 Fix available: Red Hat OpenShift AI 3.5 · Red Hat

References

Patch 3

  • TI-2026-76237 unslothai unsloth unsafe reflection via externally-controlled input CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences