CVE-2026-112075
unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
| CWE | CWE-470 |
| Vendor | unslothai |
| Product | unsloth |
| Published | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for unslothai unsloth
Be the first to know when new medium vulnerabilities affecting unslothai unsloth are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
unslothai / unsloth
0.1.501-beta
References
vuldb.com: https://vuldb.com/vuln/421754 vuldb.com: https://vuldb.com/vuln/421754/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112075 vuldb.com: https://vuldb.com/submit/1009576 github.com: https://github.com/unslothai/unsloth/issues/12419 github.com: https://github.com/unslothai/unsloth/pull/11560 github.com: https://github.com/user-attachments/files/32908312/poc.zip github.com: https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9 github.com: https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta github.com: https://github.com/unslothai/unsloth/
Credits
🔍 r1ck99 (VulDB User)