Unsloth model_type metadata reached Python execution despite remote-code trust disabled

The Unsloth model-loading pipeline interpolated the model_type value from an untrusted model configuration into generated Python execution code.

A developer had to load a model artifact with attacker-controlled configuration through the affected Unsloth or unsloth-zoo loader. Embedded source content in that metadata field could execute before model weights or tokenizer code were processed even with trust_remote_code set to false.

The reported arbitrary-code execution was a controlled reproduction, not a census of exploited AI deployments. Upgrade affected Unsloth packages to fixed versions and treat model metadata as typed data rather than executable source code.

Evidence interpretation and control boundary. Setting trust_remote_code to false can block one code-loading pathway without preventing string interpolation into an unrelated internal exec. The vulnerable Unsloth path treated a model configuration field as part of generated Python source before weight loading. An attacker needed a model artifact selected by the developer, not mere access to a public inference endpoint. Version-pinned loader validation matters independently of the model checkpoint filename.