Security Flaw in Unsloth Studio Enabled Code Execution via Rogue Hugging Face Models

Security researchers have disclosed a critical remote‑code‑execution vulnerability in Unsloth Studio, a popular web‑based interface for browsing and testing machine‑learning models. The flaw allowed any model hosted on the Hugging Face repository to run arbitrary Python code on a visitor's machine simply by being selected in the Studio browser, without requiring the user to download or execute the model locally.

The issue stemmed from how Unsloth Studio rendered model metadata. When a user clicked on a model entry, the platform fetched a JSON manifest from Hugging Face and directly evaluated embedded scripts. Malicious actors could embed a payload in the manifest, which the Studio client would then execute in the user's Python environment, potentially compromising the system or stealing data.

Unsloth responded quickly, releasing version 2026.6.9 that sanitizes incoming model descriptors and isolates any executable content. The patch also introduces a stricter content‑security policy for the browser component, preventing automatic script execution. The company has urged all users to upgrade immediately, noting that the vulnerability was exploitable in any installation running the previous versions.

While no large‑scale attacks have been publicly reported, the vector is significant because it lowers the barrier for threat actors to target data‑science teams and hobbyist developers who often explore new models on public repositories. Experts warn that similar patterns could emerge in other AI tooling platforms that trust third‑party model metadata without proper validation.

The discovery underscores the growing need for security best practices in the rapidly expanding AI ecosystem. Analysts recommend that organizations treat model repositories as potentially hostile sources, employ sandboxing for model execution, and keep all AI‑related software up to date. As AI adoption accelerates, incidents like this highlight how traditional software‑supply‑chain risks are now intersecting with machine‑learning workflows.