Sep 28, 2026

Unsloth RCE: malicious Hugging Face model config.json injects code

How to fix CVE-2026-93348: upgrade unsloth-zoo to 2026.8.14+ and unsloth to 2026.8.20+. Malicious Hugging Face model config.json model_type injects code into Unsloth exec path.

Analyze with AI

By HOL GuardHCS (Hashgraph Consensus Service) Blog

Unsloth RCE: malicious Hugging Face model config.json injects code

Read the full story

Originally published by HCS (Hashgraph Consensus Service) Blog on Sep 28, 2026.

Read on HCS (Hashgraph Consensus Service) Blog

Comments

No comments yet — be the first to share your thoughts.