Choosing a model in Unsloth Studio ran that model's code, and because the product was in beta there is no CVE to tell anyone

Unsloth is a widely used open-source library for fine-tuning and quantising large language models. Unsloth Studio, its browser interface, had a flaw in the component people use to browse models: selecting one ran code that the model's author had written.

Not loading it. Not training on it. Selecting it in a list.

The dangerous moment was looking

The mechanism is a one-line decision with a long shadow. While checking a model's configuration, Studio called into the Transformers library with trust_remote_code set to true.

That flag exists for a legitimate reason: some models ship custom Python that defines an architecture the library does not know, and loading them requires running it. It is documented, it is opt-in, and the usual advice is to set it only for models whose authors you trust.

Here it was set during a configuration check, before the model was loaded at all. The library duly fetched and executed the Python referenced from the model's config.json on the attacker's Hugging Face repository.

So the exploit path is: an attacker publishes a model with a crafted config.json, a Studio user selects it in the picker, and attacker code runs in the Studio backend process. The victim did not load weights, did not start training, did not begin inference, and was never asked to approve anything.

Every piece of advice about trust_remote_code assumes the user makes a decision at load time. This removed the decision and moved it earlier than anyone looks.

Inspection is supposed to be the safe operation

What makes this worth more than a line in a patch log is which operation became dangerous.

Every workflow for handling untrusted artefacts has the same shape. You look at the thing before you run it. You read the manifest, check the author, inspect the metadata, and then decide. That order is the control.

A model picker is the inspection step of the machine learning supply chain. It is where a practitioner is supposed to be able to look at a model safely and decide whether to trust it. Collapsing inspection into execution does not just add a vulnerability — it removes the step where the user was going to apply judgement.

It is the same shape as the GitLab AI gateway flaw this week, where a prompt template escaped into the host. In both cases the product feature is that users supply something expressive, and the security depends entirely on a boundary nobody can see.

No advisory, no identifier, no alert

Unsloth fixed it in 2026.6.9, which stopped loading arbitrary models directly from Hugging Face and stopped trusting remote code from local model files on Studio's inspection path.

The maintainers declined to publish an advisory, on the grounds that Studio was in beta. No CVE was assigned.

Without an identifier there is no entry in a vulnerability database, so dependency scanners do not flag it, software composition analysis does not report it, automated upgrade bots do not raise it, and nobody's patch management process produces a ticket. The fix exists and is shipped; the mechanism that would tell an organisation to apply it does not.

Beta is a statement about product maturity and feature stability. It is not a statement about whether people are running the software, and in the machine learning tooling ecosystem, beta software is what most of the work is done with.

There is a separate identifier nearby: CVE-2026-93348, a code injection flaw in unsloth-zoo affecting versions from 2025.9.9 before 2026.8.14. That one is tracked. Teams checking their exposure should look for both, and only one of them will appear in a scan.

What to do

• Upgrade Unsloth to 2026.6.9 or later. Nothing will prompt you to, so this is a manual check.
• Separately check unsloth-zoo against CVE-2026-93348. That one your scanners will see.
• Treat trust_remote_code as a privilege, not a convenience. Grep your own pipelines for it, and confirm every place it is true is a place where a human decided to trust that specific publisher.
• Run model inspection somewhere disposable. If browsing a model registry can execute code, the machine doing the browsing should not be a workstation with cloud credentials on it.
• Do not use the presence of a CVE as a proxy for whether a fix matters. This one had no identifier and a real exploit path, and that combination is more common in fast-moving tooling than in mature software.

What is not established

• Whether anyone exploited this. No reporting says so, and a model picker leaves little evidence behind.
• How many Studio installations were affected, which is unknown because beta installs are not counted.
• Whether any model currently on Hugging Face carries a config crafted for this.
• Whether other model-management tools call into the same configuration path with remote code trusted. The flag is widely used, and this report covers one product.