Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user when the model is loaded for training or inference.

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives timm: Hugging Face PyTorch Image Models: Remote Code Execution via Deserialization of Untrusted Data buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability @fastify/static: @fastify/static: Information disclosure via route guard bypass undici: undici: Denial of Service via unrequested WebSocket subprotocol vllm: vLLM: Denial of Service via memory exhaustion from oversized media files lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing anyio: AnyIO: TLS certificate spoofing via imprope…