---
id: "CVE-2026-112075"
kind: "vulnerability"
aliases: ["CVE-2026-112075"]
title: "Unsloth: unsafe class selection in sentence transformer loader allows code execution"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ml-pipelines", "package", "python", "unsloth"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T04:17:09+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:23:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112075", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Unsloth: unsafe class selection in sentence transformer loader allows code execution

Unsloth up to 0.1.501-beta uses attacker-influenced input to choose classes to load in FastSentenceTransformer._is_transformer_module_ref, which can lead to code being run. The sources describe the flaw as remotely triggerable and say a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show unsloth` and check whether the version is `0.1.501-beta` or lower
- Check whether code calls `FastSentenceTransformer` from `unsloth/models/sentence_transformer.py` on model or config input from outside the team

## Fix

- Upgrade unsloth to `0.1.902-beta` or later (patch de801746386a53a0cb26216e715a0af863b76ad9)

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112075

## From the sources

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_