vibehacker
News
Pillar Security ·

Unsloth Studio: inspecting a model could run its Hugging Face code

Pillar Security found Unsloth Studio’s model picker ran Hugging Face auto_map Python during a metadata check (trust_remote_code=True by default)—before weights loaded. Fixed in unsloth 2026.6.9; no CVE (Studio listed as beta). Upgrade if you run Studio.

More news

View all

Spotted something we missed? Start a thread.