Unsloth Studio: Merely Selecting a Hugging Face Model Ran the Attacker's Python

Unsloth Studio, the web UI of the Unsloth open-source fine-tuning library, shipped in the `unsloth` PyPI package

Pillar Security disclosed on September 29, 2026 that Unsloth versions up to 2026.5.10 executed code from a model repository as soon as a user selected the model in Studio, before any weights were loaded or inference run. The backend inspected models with `trust_remote_code=True`, overriding the user's setting, so an `auto_map` entry in a malicious repository's `config.json` pointed Transformers at attacker Python that ran with the operator's permissions, exposing Hugging Face tokens, cloud credentials, SSH keys, training data, and model artifacts. Fixed in 2026.6.9 in June; the maintainers declined to publish an advisory, citing Studio's beta status, so there is no CVE

A metadata probe treated "look at this model" as "run this model's code," a pattern that has produced several CVEs in other ML tools