Trust disabled, code still executes: arbitrary code execution vulnerability in the Unsloth model loader
Trust Disabled, Code Executed: Arbitrary Code Execution in Unsloth’s Model Loader
Pillar Security disclosed an arbitrary code execution vulnerability, CVE-2026-93348, in Unsloth's model loading path, with a CVSS v4.0 score of 8.6. Unsloth dynamically constructs import statements using model_type from the model configuration and executes them via exec(); an attacker can inject newlines and additional Python statements into a nested model_type, causing code to run before weights are loaded, and trust_remote_code=False does not prevent it; injected code inherits the permissions of the loading process and can access proprietary datasets, model artifacts, Hugging Face tokens and cloud credentials. The maintainer merged an initial fix about six hours after a private report on August 22; unsloth_zoo 2026.8.14 first included the fix, and unsloth 2026.8.20 raised the minimum Zoo dependency, but because the maintainer did not respond to disclosure coordination, VulnCheck published the CVE on September 28.
Attacker-controlled model configurations become executable code via exec(), and trust_remote_code=False does not stop it either; teams relying on Unsloth can check their notebooks and training environments against the version range in the article.