CVE-2026-112075: unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer.istransformermoduleref of the file unsloth/models/sentencetransformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
unslothai/unslothto a version that resolves this vulnerability.Fixed in 0.1.902-betaPatch de801746386a53a0cb26216e715a0af863b76ad9
Event History
Frequently Asked Questions
Which unsloth versions need remediation?
The issue affects unsloth versions up to 0.1.501-beta. Upgrade the affected component to version 0.1.902-beta, which mitigates the issue; the associated patch is de801746386a53a0cb26216e715a0af863b76ad9.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges, but it requires user interaction. Public exploit code is available, increasing the likelihood of attempted exploitation.
What is the potential impact?
The weakness allows externally controlled input to influence class or code selection in FastSentenceTransformer._is_transformer_module_ref. Successful exploitation can affect confidentiality, integrity, and availability at a low impact level.