Threat database

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

Unsloth Zoo versions from 2025.9.9 up to but not including 2026.8.14 contain a code injection vulnerability in the model-loading compile path. The vulnerability arises because the get_transformers_model_type() function does not enforce a character allowlist on model_type values, allowing malicious input to inject arbitrary Python code. This can lead to remote code execution when a malicious model is loaded for training or inference.