Machine learning teams that set trust_remote_code=False believing the door is shut remain exposed to a flaw Pillar Security disclosed in Unsloth’s model loader.
It carries CVE-2026-93348 and a CVSS score of 8.6, and it permits arbitrary Python execution when a maliciously crafted model loads. The vulnerable path never touches Hugging Face’s remote-code mechanism, so that safety flag has nothing to switch off.
How a type name becomes code
Unsloth reads a model architecture identifier out of the configuration file and uses it to build an import statement. Validation on that value was loose enough that an attacker can graft extra Python statements onto the same import, which then run through exec(). Whatever the loader itself was allowed to touch becomes available to the intruder. In practice that covers trade-secret datasets, the trained weights, any Hugging Face tokens on the box and cloud credentials.
Pillar’s testing showed execution starting before weights or tokenizers were read, so there is no chance to spot a malformed model first.
Versions and remediation
Two package lines are exposed, each with its own cutoff. For Unsloth Zoo the vulnerable span opens at 2025.9.9 and ends just short of 2026.8.14. For Unsloth itself the same opening date applies and the safe build is 2026.8.20. Within hours of Pillar’s August 22 private report a fix had landed, the researchers say, yet the maintainers then stopped answering further contact. VulnCheck helped get the identifier assigned.
The immediate job is inventory. Sweep AI notebooks, training workers and container images for a pinned copy. Where an upgrade must wait, treat every downloaded model configuration as untrusted input and diff its architecture string against a known-good copy.
