CVE-2026-112075

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112075

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112075.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112075

Published

2026-10-19T03:45:20Z

Modified

2026-10-21T02:56:02Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code

Details

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-470"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112075.json"
}

References

Affected packages

Git / github.com/unslothai/unsloth

Affected ranges

Type

GIT

Repo

https://github.com/unslothai/unsloth

Events

Introduced

beddfc963ec1430c9b9c6dc06d38e38fd95e87e1

Last Affected

beddfc963ec1430c9b9c6dc06d38e38fd95e87e1

Fixed

de801746386a53a0cb26216e715a0af863b76ad9

Fixed

1b588389b488eb9f8a9cb8ad5ca3073c7661f073

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.1.501-beta"
                },
                {
                    "last_affected":  "0.1.501-beta"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "de801746386a53a0cb26216e715a0af863b76ad9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v0.1.902-beta",
            "range":  [
                {
                    "fixed":  "1b588389b488eb9f8a9cb8ad5ca3073c7661f073"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.1.501-beta

v0.*

v0.1.501-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112075.json"