Critical RCE in Unsloth Studio Lets Malicious Hugging Face Models Execute Code

Key Takeaways

• A critical remote code execution (RCE) vulnerability was discovered in Unsloth Studio, a popular browser-based interface for fine-tuning large language models.
• The flaw allowed malicious Hugging Face models to execute arbitrary Python code on a user’s system simply by being selected in the Studio interface.
• The vulnerability, which did not receive a CVE, has been patched in Unsloth Studio version 2026.6.9, and users are urged to upgrade immediately.
• Exploitation could lead to theft of sensitive credentials, data manipulation, or further compromise of AI development infrastructure.

A significant security flaw in Unsloth Studio, a widely used platform for optimizing large language models (LLMs), permitted unauthorized Python code execution through specially crafted Hugging Face models. The vulnerability, now resolved, enabled attackers to run arbitrary code on a user’s system merely by the user selecting a malicious model within the Studio’s browser-based interface.

Unsloth, an open-source library renowned for its efficiency in fine-tuning and quantizing LLMs, offers the Studio component as a beta-stage, user-friendly graphical interface for streamlined model selection, training, and workflow management. The project’s influence within the AI ecosystem is substantial; Hugging Face ranks Unsloth as the third-largest producer of model derivatives on its Hub, trailing only Qwen and Google.

The critical flaw was addressed in Unsloth Studio version 2026.6.9. All users operating Studio installations are strongly advised to update without delay to mitigate the risk of compromise.

Understanding the Unsloth Studio RCE Flaw

The vulnerability stemmed from a misconfiguration within Unsloth Studio’s backend model-inspection process. When a user interacted with the interface to choose a Hugging Face model, Studio would perform a preliminary check of the model’s configuration before proceeding to load weights or initiate inference. Crucially, this code path inadvertently enabled the trust_remote_code=True setting by default.

The Danger of trust_remote_code=True

The trust_remote_code=True parameter is a powerful yet inherently risky setting within the Hugging Face Transformers library. It permits model repositories to include custom Python files alongside standard model weights and configuration data. When enabled, the config.json file within a repository can leverage the auto_map field to direct Transformers components, such as AutoConfig, to these local Python files. Consequently, the Transformers library will import and execute the repository-provided module.

In the vulnerable versions of Unsloth Studio, this execution occurred during what appeared to be a benign metadata inspection. An attacker could craft a malicious model repository containing a specially designed config.json. If a Studio user then selected this repository through the interface, the embedded malicious code would automatically execute within the Studio backend process.

Significantly, the victim did not need to perform any advanced actions like loading model weights, initiating training, starting inference, or explicitly approving remote code execution. The malicious code would run with the same permissions as the user operating Studio.

Potential Impact of Exploitation

On systems used for AI development, such an exploit could have severe ramifications. Attackers might gain unauthorized access to critical assets, including Hugging Face tokens, cloud provider credentials, SSH keys, proprietary datasets, valuable model artifacts, and sensitive training outputs. Furthermore, successful exploitation could enable attackers to tamper with local models, establish persistent access to the compromised system, or leverage accessible credentials to expand their reach into other infrastructure.

The vulnerable logic was integrated into the standard Unsloth Python package, not a separate, pre-release-only component. While exploitation required the victim to actively run Studio and select an attacker-controlled model, the affected code could be installed via a routine pip install unsloth command.

Pillar Security reported the issue privately to Unsloth’s maintainers in early June 2026. A patch was subsequently released on June 18. Researchers independently confirmed that version 2026.6.9 effectively closes both the vulnerable Hugging Face and local-directory model-loading pathways.

Despite the critical nature of the flaw, Unsloth’s maintainers opted not to publish a formal security advisory, citing Studio’s beta status, and therefore, no CVE identifier was assigned.

What You Should Do

• Upgrade Unsloth Studio Immediately: All users of Unsloth Studio must upgrade to version 2026.6.9 or a later release to eliminate this critical vulnerability.
• Exercise Caution with trust_remote_code=True: Security teams should treat any use of the trust_remote_code=True setting as equivalent to executing untrusted software, rather than a standard model-loading option.
• Pin Model Repositories: Always pin model repositories to known, trusted revisions to prevent inadvertent loading of malicious or compromised versions.
• Isolate Environments: Load and run models in isolated, sandboxed environments to contain potential exploits and limit their impact.
• Limit Credential Access: Implement strict access controls and prevent long-lived, high-privilege credentials from being accessible within model loading or training environments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.