Unsloth Zoo
Monthly
Loading a malicious model into Unsloth Zoo 2025.9.9 through 2026.8.13 (as shipped in Unsloth 2025.9.9 through 2026.8.19) lets that model's config.json run arbitrary Python in the loading user's process, because a nested model_type value containing a newline escapes into an exec()-generated import statement. Exploitation requires the victim to load an attacker-controlled model for training or inference - a user-interaction gate, but no authentication on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; vendor score 8.6). No public exploit code has been identified at time of analysis, and the practical exposure is concentrated in pipelines that automatically ingest third-party or user-supplied models from public hubs rather than those loading only vetted first-party checkpoints.
Loading a malicious model into Unsloth Zoo 2025.9.9 through 2026.8.13 (as shipped in Unsloth 2025.9.9 through 2026.8.19) lets that model's config.json run arbitrary Python in the loading user's process, because a nested model_type value containing a newline escapes into an exec()-generated import statement. Exploitation requires the victim to load an attacker-controlled model for training or inference - a user-interaction gate, but no authentication on the attacker side (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; vendor score 8.6). No public exploit code has been identified at time of analysis, and the practical exposure is concentrated in pipelines that automatically ingest third-party or user-supplied models from public hubs rather than those loading only vetted first-party checkpoints.