Code Injection in Unsloth Zoo via Malicious Model Config

Executive Summary

This is a code injection vulnerability in Unsloth Zoo and Unsloth versions between 2025.9.9 and 2026.8.14/2026.8.20. The issue occurs in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py fails to restrict model_type values from nested model configurations. Attackers can inject newlines and arbitrary Python code into a model's config.json file, allowing them to terminate import statements and execute code via exec() during model loading for training or inference.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect model config.json files for malicious model_type values containing newlines or Python code. Check Unsloth Zoo versions between 2025.9.9 and 2026.8.14 and Unsloth versions between 2025.9.9 and 2026.8.20. Use grep to search for suspicious patterns in config files.

Useful 0 Not Useful 0

Impact Analysis

If you use affected Unsloth Zoo or Unsloth versions, an attacker could exploit this to run arbitrary Python code on your system with the same permissions as the user loading the model. This could lead to data theft, system compromise, or unauthorized actions during model training or inference.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches or loss of sensitive information. Such incidents may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, leading to legal penalties, reputational damage, and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Unsloth and Unsloth Zoo to versions 2026.8.15 or later. Review and validate all model_type values in config.json files to ensure they only contain allowed characters. Remove any models with suspicious model_type values containing newlines or code.

Useful 0 Not Useful 0