Loading story…
A now-patched remote-code-execution flaw in Unsloth Studio allowed attacker-controlled Hugging Face model repositories to run arbitrary Python code when an operator merely selected a model in the Studio browser interface. The backend inspection workflow enabled trust_remote_code=True by default, allowing a crafted config.json auto_map entry to make Hugging Face Transformers import Python modules supplied by the repository; exploitation did not require loading model weights, starting inference or training, or separately approving remote code execution.
The payload ran with the Studio operator's privileges and could expose Hugging Face tokens, cloud credentials, SSH keys, proprietary datasets, and model artifacts. Pillar Security privately reported the issue in early June 2026, and Unsloth fixed it in version 2026.6.9 on June 18; no CVE or public advisory was issued because Studio was in beta. Organizations using Studio should upgrade to 2026.6.9 or later and isolate model-loading workflows from sensitive credentials and resources.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Unsloth released version 2026.6.9, fixing vulnerable Hugging Face model-loading and local-directory model-loading paths in Studio. Independent researchers verified that the affected paths were closed.
Pillar Security privately reported that Unsloth Studio's model-inspection workflow could execute attacker-supplied Python from a malicious Hugging Face repository when a user selected the model. The issue stemmed from enabling trust_remote_code by default during configuration inspection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw in Hugging Face's `transformers` library allowed attacker-controlled model repositories to run arbitrary code during the standard `from_pretrained()` loading process, even when `trust_remote_code=False` was set. The issue was tied to unsafe handling of untrusted model configuration data, including nested configuration resolution in the LightGlue loading path, where values from `config.json` could override the intended safety setting and trigger execution of attacker-supplied Python modules during model initialization. Reports said the vulnerability affected `transformers` versions `4.56.0` through `5.2.x` in environments where the `kernels` package was installed, with version `5.2.0` specifically cited in LightGlue-related exploitation scenarios. Exposed targets included inference servers, research notebooks, CI/CD pipelines, and automated model evaluation systems, where successful compromise could enable theft of cloud credentials, API keys, SSH keys, proprietary datasets, lateral movement, persistence, and backdoor deployment. Hugging Face released a fix in `transformers` `5.3.0` and urged organizations to upgrade and treat model loading as a code execution surface.
Jun 29, 2026
Researchers disclosed three high-severity vulnerabilities in Hugging Face’s **Diffusers** library that allow a crafted model repository to bypass the `trust_remote_code` safeguard and execute arbitrary code when a model is loaded. The issues, collectively dubbed **FaceHugger**, affect workflows using `DiffusionPipeline.from_pretrained` with custom pipelines and stem from **time-of-check to time-of-use** flaws in the model download and loading process, where trust validation occurs before later content can be swapped or injected through non-atomic HTTP requests. The disclosure names **`CVE-2026-44827`**, **`CVE-2026-45804`**, and variants grouped under **`CVE-2026-44513`**, and also points to a related trust issue in Hugging Face’s **Transformers** library involving pinned commit hash propagation. Because Diffusers is widely used in production AI pipelines, CI/CD environments, and containerized workloads, successful exploitation could turn a routine model pull into an enterprise initial-access vector. The vulnerabilities were patched in **Diffusers 0.38.0**, and defenders are being urged to upgrade, pin repository revisions, and treat AI model repositories as untrusted executable content.
Aug 11, 2026
A critical vulnerability tracked as **CVE-2026-68770** affects Hugging Face's `sentence-transformers` package and allows **arbitrary code execution** when a model is loaded from a local path, even if applications explicitly set `trust_remote_code=False`. The flaw stems from a logic error in the `import_module_class` helper in `sentence_transformers/util/misc.py`, where an `or os.path.exists(model_name_or_path)` condition accepts existing local filesystem paths and can cause malicious Python code referenced through `modules.json` to run during import. The issue is classified as **CWE-94** and carries a **CVSS 3.1 score of 9.8**, with high impact to confidentiality, integrity, and availability. The bug affects `sentence-transformers` through **version 5.5.1** and creates a significant AI/ML supply-chain risk for organizations that load models from disk or from directories an attacker can influence. Reporting indicates no active exploitation had been confirmed at publication, but maintainers have released a fix, with coverage pointing to **version 5.6.1** as the remediated release. Organizations using local model-loading workflows are being urged to upgrade immediately and tighten controls around model directories, stored artifacts, and any process that imports untrusted model content.
Aug 1, 2026