CVE-2026-93348 Vulnerability Analysis & Exploit Details

CVE-2026-93348 Vulnerability Summary

CVE-2026-93348: Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.

CVE-2026-93348 References

External References

• https://github.com/unslothai/unsloth-zoo/pull/1083
• https://github.com/unslothai/unsloth-zoo/pull/1108
• https://github.com/unslothai/unsloth/commit/92ee0207a38ebc8af1a0e678aa92d7e7d901ea0d
• https://www.vulncheck.com/advisories/unsloth-zoo-code-injection-via-model-type-in-config-json

CWE Common Weakness Enumeration

CAPEC Common Attack Pattern Enumeration and Classification

• Code Injection CAPEC-242 An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
• Leverage Executable Code in Non-Executable Files CAPEC-35 An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
• Manipulating User-Controlled Variables CAPEC-77 This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Other 5 Recently Published CVEs Vulnerabilities

• CVE-2026-88816 – DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of th...
• CVE-2026-88815 – DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_s...
• CVE-2026-87969 – An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating syst...
• CVE-2026-87114 – A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's ent...
• CVE-2026-86102 – An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitra...