Unsloth RCE: malicious Hugging Face model config.json injects code
How to fix CVE-2026-93348: upgrade unsloth-zoo to 2026.8.14+ and unsloth to 2026.8.20+. Malicious Hugging Face model config.json model_type injects code into Unsloth exec path.
HCS (Hashgraph Consensus Service) Blog4 min read