Security2 hSeptember 30, 2026, 04:08

Unsloth Studio flaw let malicious AI models run Python code on inspection

A patched vulnerability in Unsloth Studio allowed malicious AI models to execute arbitrary Python code during routine inspection via the trust_remote_code setting.

Dark Reading

Open source

Flaw enabled arbitrary Python code execution during model inspection
Attack vector was the trust_remote_code setting
Patch for Unsloth Studio has been released

#Unsloth

MCP Python SDK flaw lets malicious servers steal OAuth credentials

Security

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Security

cPanel flaw lets a hosting account run code as root and take over the server

Security

Unsloth Studio flaw let malicious AI models run Python code on inspection

MCP Python SDK flaw lets malicious servers steal OAuth credentials

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

cPanel flaw lets a hosting account run code as root and take over the server

WordPress Click2Shell flaw lets hackers run PHP on the server