unslothai CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW unslothai CVE published 2026-10-19

CVE-2026-112075

A weakness in unslothai unsloth up to 0.1.501-beta allows for use of externally-controlled input to select classes or code. The attack may be initiated remotely. Upgrading to version 0.1.902-beta mitigates this issue. This vulnerability affects the function FastSentenceTransformer._is_transformer_module_ref in unsloth/models/sentence_transformer.py, enabling attackers to potentially leverage this weakness [truncated]