Trusting Unsloth’s trust setting could mean executing malicious code

Summary

Pillar Security disclosed CVE-2026-93348, a high-severity flaw (CVSS 8.6) in Unsloth's model loader that allows arbitrary Python code execution through a maliciously crafted model configuration. Setting trust_remote_code=False does not prevent exploitation, because the vulnerable path does not use Hugging Face's remote-code mechanism. Unsloth Zoo versions 2025.9.9 to before 2026.8.14 and Unsloth versions 2025.9.9 to before 2026.8.20 are affected.

Mitigation

Update Unsloth Zoo to 2026.8.14 or later, and Unsloth to 2026.8.20 or later.

Related items

• MediumAttackers compromised 42 GitHub repositories by using files too large to be searchedSimilar attack · CSO Online
• LowBank of America kindly asks that you don’t share your banking password with your AI assistantSimilar attack · TechCrunch (Security)
• HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSimilar attack · Hugging Face Security Advisories
• MediumWarp discloses breach exposing AI agent logs, user telemetry dataSimilar attack · BleepingComputer
• LowResearchers Break Into Anthropic’s Systems in Just 12 Hours—Through Third-Party SoftwareSimilar attack · ReversingLabs Blog