Unsloth CVE-2026-112075

Exploitation requires the victim to load an attacker-influenced input (a model, tokenizer, or configuration artifact) that reaches FastSentenceTransformer._is_transformer_module_ref in unsloth/models/sentence_transformer.py, where the 'Type' argument is used to select a class or code path via reflection. The vendor vector marks UI:P, so passive user interaction (loading/processing the crafted artifact) is a prerequisite - this is NOT exploitation of an exposed network service at rest. Limiting factors: affected versions are unsloth up to 0.1.501-beta (upgrade to 0.1.902-beta mitigates); impact is bounded to Low confidentiality/integrity/availability; and realistic exploitation depends on the victim ingesting untrusted model/config data rather than default-configuration remote access.

This is a moderate-severity, low-priority issue despite the 'remote' labeling. The CWE-470 (unsafe reflection) flaw in unsloth's FastSentenceTransformer._is_transformer_module_ref lets externally-controlled input select which class/code path is used, but the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) caps all three impacts at Low and requires passive user interaction, yielding only 5.3. Signals are mixed: a public POC exists and SSVC-style exploit maturity is Proof-of-Concept (E:P), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread or automated exploitation - exploitation status is 'publicly available exploit code exists', which must not be conflated with active exploitation. Note a signal tension: the vector claims AV:N (network) and PR:N (no privileges), yet the vulnerable function is a transformer-module reference check that is realistically triggered by loading a crafted model/config artifact - i.e., it behaves like a local/supply-chain trust issue dependent on user-supplied input (UI:P), not a true unauthenticated network service. Verify the real attack surface with the vendor before treating AV:N literally. Overall: a genuine code-selection weakness worth patching, but not an emergency given low impact, no KEV, and no EPSS.

An attacker publishes or supplies a malicious model/configuration artifact whose type/module reference is crafted so that unsloth's _is_transformer_module_ref resolves attacker-chosen classes or code paths. A victim who loads this artifact in an unsloth fine-tuning/inference workflow (UI:P) triggers the unsafe reflection, letting the attacker influence which code is instantiated. A public POC (poc.zip) is available, lowering the barrier to reproduction.