CVE-2026-112075

Description

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

References

https://vuldb.com/vuln/421754/cti

https://vuldb.com/vuln/421754

https://vuldb.com/submit/1009576

https://vuldb.com/cve/CVE-2026-112075

https://github.com/user-attachments/files/32908312/poc.zip

https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta

https://github.com/unslothai/unsloth/pull/11560

https://github.com/unslothai/unsloth/issues/12419

https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9

https://github.com/unslothai/unsloth/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104057

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS