{"id":"CVE-2026-112075","kind":"vulnerability","aliases":["CVE-2026-112075"],"related":[],"title":"Unsloth: unsafe class selection in sentence transformer loader allows code execution","description":"A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.","summary":"Unsloth up to 0.1.501-beta uses attacker-influenced input to choose classes to load in FastSentenceTransformer._is_transformer_module_ref, which can lead to code being run. The sources describe the flaw as remotely triggerable and say a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ml-pipelines","package","python","unsloth"],"not_affected_if":["default-config"],"how_to_check":"- Run `pip show unsloth` and check whether the version is `0.1.501-beta` or lower\n- Check whether code calls `FastSentenceTransformer` from `unsloth/models/sentence_transformer.py` on model or config input from outside the team","fix":"- Upgrade unsloth to `0.1.902-beta` or later (patch de801746386a53a0cb26216e715a0af863b76ad9)","status":"open","published_at":"2026-10-19T04:17:09+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:23+00:00","updated_at":"2026-10-25T03:23:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:23:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade unsloth to `0.1.902-beta` or later (patch de801746386a53a0cb26216e715a0af863b76ad9)","reach":"internet","title":"Unsloth: unsafe class selection in sentence transformer loader allows code execution","impact":"high","summary":"Unsloth up to 0.1.501-beta uses attacker-influenced input to choose classes to load in FastSentenceTransformer._is_transformer_module_ref, which can lead to code being run. The sources describe the flaw as remotely triggerable and say a public exploit exists.","category":"package","nicknames":[],"who_cares":["python","unsloth","ml-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-chosen code runs in the process loading the model","analyst_note":"Confirm the exact input that reaches the Type argument and whether the public exploit needs the model source to be attacker-controlled; check the NVD and patch commit pages.","how_to_check":"- Run `pip show unsloth` and check whether the version is `0.1.501-beta` or lower\n- Check whether code calls `FastSentenceTransformer` from `unsloth/models/sentence_transformer.py` on model or config input from outside the team","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that run unsloth up to 0.1.501-beta and load sentence transformer models through FastSentenceTransformer, especially where the model name, config or module reference comes from users or untrusted sources. Teams on the patched version, or who only load fixed, locally vetted models, are less exposed; the sources do not say which input path is needed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000646,"input_tokens":3410,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112075':14A,17A '-2026':13A,16A '0.1.501':27B,72C '0.1.902':125C 'abl':128C 'affect':75C,137C 'allow':9A 'argument':87C 'attack':31B,102C,121C 'attacker-influenc':30B 'avail':112C 'beta':28B,73C,126C 'caus':89C 'choos':35B 'class':3A,36B,98C 'code':10A,45B,100C 'compon':138C 'control':94C 'could':117C 'cve':12A,15A 'de801746386a53a0cb26216e715a0af863b76ad9':135C 'describ':50B 'execut':11A 'exist':61B 'exploit':60B,108C 'extern':93C 'externally-control':92C 'fastsentencetransformer._is_transformer_module_ref':40B,78C 'file':81C 'flaw':52B 'function':77C 'identifi':66C 'influenc':32B 'initi':105C 'input':33B,95C 'issu':132C 'lead':43B 'load':38B 'loader':8A 'made':111C 'manipul':84C 'may':103C 'mitig':130C 'ml':19B 'ml-pipelin':18B 'name':134C 'packag':21B 'patch':133C 'pipelin':20B 'public':59B,115C 'python':22B 'remot':54B,106C 'run':47B 'say':57B 'select':4A,97C 'sentenc':6A 'sourc':49B 'transform':7A 'trigger':55B 'type':88C 'unsaf':2A 'unsloth':1A,23B,24B,69C 'unsloth/models/sentence_transformer.py':82C 'unslothai':68C 'upgrad':122C,141C 'use':29B,90C,119C 'version':124C 'weak':63C","nicknames":[],"mitigations":[],"who_affected":"Teams that run unsloth up to 0.1.501-beta and load sentence transformer models through FastSentenceTransformer, especially where the model name, config or module reference comes from users or untrusted sources. Teams on the patched version, or who only load fixed, locally vetted models, are less exposed; the sources do not say which input path is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T04:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112075","severity":null,"published_at":"2026-10-19T04:17:09+00:00","modified_at":"2026-10-19T17:17:10+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}