Evidence · DiggingBeagle record
Pillar Security: model metadata code execution in Unsloth
Technical analysis of unsloth-zoo config model_type reaching Python exec despite trust_remote_code disabled.
- Source role
- independent technical reproduction
Evidence record
Technical analysis of unsloth-zoo config model_type reaching Python exec despite trust_remote_code disabled.
Claim-level citations (2)
- supportsUnsloth model_type metadata reached Python execution despite remote-code trust disabled: Pillar Security demonstrates that model_type text from an untrusted model config could reach executable Python source generation in affected Unsloth loaders even when trust_remote_code was disabled.
Pillar Security: model_type interpolation, trust_remote_code=false reproduction and fix details
- supportsUnsloth model_type metadata reached Python execution despite remote-code trust disabled: The Unsloth model-loading pipeline interpolated the model_type value from an untrusted model configuration into generated Python execution code. A developer had to load a model artifact with attacker-controlled configuration through the affected Unsloth or unsloth-zoo loader. Embedded source content in that metadata field could execute before model weights or tokenizer code were processed even with trust_remote_code set to false.
Pillar Security: model_type interpolation, trust_remote_code=false reproduction and fix details