Skip to content
Heist/ feed
Back to feed
Low

unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code

Type: advisorySources: OSV

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-112075
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 08:38 UTC · Revision 1

Source evidence

unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code

core-osv · Original source

Published 19 Oct 2026, 03:45 UTC

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

osv:CVE-2026-112075
Complete source record
{
  "id": "b5a9942a3159e75dda95eeaeeb05694ac23910f2692a402d0236c0631adf8ba0",
  "url": "https://osv.dev/vulnerability/CVE-2026-112075",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code",
    "summary": "A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.",
    "evidence": "osv:CVE-2026-112075",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-112075",
      "aliases": [
        "CVE-2026-112075"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/unslothai/unsloth",
              "type": "GIT",
              "events": [
                {
                  "introduced": "beddfc963ec1430c9b9c6dc06d38e38fd95e87e1"
                },
                {
                  "fixed": "de801746386a53a0cb26216e715a0af863b76ad9"
                },
                {
                  "fixed": "1b588389b488eb9f8a9cb8ad5ca3073c7661f073"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.1.501-beta"
                      },
                      {
                        "last_affected": "0.1.501-beta"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                  },
                  {
                    "range": [
                      {
                        "fixed": "de801746386a53a0cb26216e715a0af863b76ad9"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1b588389b488eb9f8a9cb8ad5ca3073c7661f073"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.1.902-beta"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.1.501-beta",
            "v0.1.815-beta",
            "v0.1.814-beta",
            "v0.1.813-beta",
            "v0.1.812-beta",
            "v0.1.811-beta",
            "v0.1.810-beta",
            "Windows-ARM64",
            "v0.1.808-beta",
            "v0.1.807-beta",
            "v0.1.806-beta",
            "v0.1.805-beta",
            "v0.1.804-beta",
            "v0.1.803-beta",
            "v0.1.802-beta",
            "v0.1.801-beta",
            "v0.1.800-beta",
            "v0.1.71-beta",
            "v0.1.702-beta",
            "v0.1.701-beta",
            "v0.1.70-beta",
            "v0.1.62-beta",
            "v0.1.61-beta",
            "v0.1.60-beta",
            "desktop-v0.1.527-beta",
            "v0.1.527-beta",
            "desktop-v0.1.526-beta",
            "v0.1.526-beta",
            "v0.1.525-beta",
            "v0.1.524-beta",
            "v0.1.523-beta",
            "v0.1.522-beta",
            "v0.1.521-beta",
            "v0.1.52-beta",
            "v0.1.512-beta",
            "v0.1.511-beta",
            "v0.1.51-beta",
            "v0.1.501-beta"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112075.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:27.084973202Z",
      "provider": "osv",
      "references": [
        "https://github.com/unslothai/unsloth/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112075.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-112075",
        "https://vuldb.com/cve/CVE-2026-112075",
        "https://vuldb.com/submit/1009576",
        "https://vuldb.com/vuln/421754",
        "https://github.com/unslothai/unsloth/issues/12419",
        "https://vuldb.com/vuln/421754/cti",
        "https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9",
        "https://github.com/unslothai/unsloth/pull/11560",
        "https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta",
        "https://github.com/user-attachments/files/32908312/poc.zip"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-470"
        ],
        "cna_assigner": "VulDB",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112075.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-112075",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493912,
  "published_at": "2026-10-19T03:45:20.785+00:00"
}