A flaw in Unsloth Studio, the web interface for the widely used open-source Unsloth fine-tuning library, allowed a malicious Hugging Face model repository to run code on a user's machine as soon as the model was selected or inspected, GBHackers on Security reported. The issue, found by Pillar Security, was fixed in version 2026.6.9 and disclosed publicly this week.

What Happened

Pillar Security researcher Ariel Fogel found that Studio's backend enabled Hugging Face's trust_remote_code=True option by default when it checked a chosen model's configuration and capabilities, according to GBHackers. The weakness sat in the model configuration and vision-check API endpoints.

That default opened a simple attack path. A repository's config.json file can include an auto_map field that tells the Hugging Face Transformers library to load custom Python classes stored in the same repository. An attacker who published a model with such a field could point it at a Python file of their choosing. When Studio queried the configuration, Transformers fetched and imported the attacker's module.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

No further step was needed. The user did not have to download the model's weights, start inference or explicitly approve remote code. GBHackers summarized the shift as a metadata check, normally seen as low risk, becoming the trigger for execution.

The code ran with the permissions of the Studio backend process. That could expose Hugging Face authentication tokens, cloud credentials, SSH keys, proprietary datasets, model weights, training outputs and experiment configurations. The Studio instance did not need to be reachable from the internet: a logged-in user selecting a malicious repository on a local deployment was enough.

Timeline and Fix

Pillar reported the problem privately to Unsloth in early June, and the fix shipped on June 18 in version 2026.6.9, Cybersecurity News reported. The patched code no longer permits arbitrary Hugging Face model loading through the vulnerable inspection path and limits trust of remote code from local model files, according to GBHackers.

No CVE has been assigned. Unsloth did not publish an advisory because Studio is a beta feature, the reports said, which means users who do not follow release notes may not know they were exposed.

Why It Matters

Hugging Face's remote-code mechanism exists so that model authors can ship custom architectures, but it effectively turns a model repository into executable software. Tools that enable it silently shift the risk onto users, who may reasonably expect that browsing or checking a model is safe.

Unsloth is popular with developers fine-tuning and quantizing open-weight models on their own hardware, and those machines often hold exactly the credentials an attacker would want: tokens for model hubs, cloud accounts used for training and SSH access to other systems. A single malicious repository could therefore provide a foothold into an AI team's wider infrastructure.

What to Watch

Users should upgrade Studio to 2026.6.9 or later. The researchers also advise teams to audit anywhere trust_remote_code=True is set, treat repositories that require remote code as untrusted software, require explicit approval before enabling it, pin models to known revisions and load them in isolated environments away from long-lived credentials. Beyond Unsloth, watch whether other fine-tuning and model-management tools review how their own model-inspection features handle remote code by default.