CVE-2026-112075
Description
A flaw was found in unsloth. The sentence transformer module improperly validates user-controlled input when resolving class references. A remote attacker could exploit this vulnerability by enticing a user to process specially crafted input, potentially leading to arbitrary code execution and unintended application behavior.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to prevent FastSentenceTransformer from passing unvalidated class paths from model configuration files to dynamic import functions: upgrade to unsloth 0.1.902-beta (or the fixed Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel builds), which wrap RotaryEmbeddingConfigMixin.validate_rope and overriding config classes to accept ignore_keys positionally or as a keyword and restore is_torch_fx_available, closing all 2 injection vectors (crafted modules.json configuration file, untrusted model loading). Until patched, this is a concern on Deployments loading sentence-transformers model repositories or directories using unsloth FastSentenceTransformer on any platform, so Restrict and audit loading of model repositories or directories, ensuring sentence-transformers modules.json files originate solely from trusted and verified sources. As a compensating measure, Deploy an EDR agent to detect malicious execution patterns, spawned shells, or unauthorized behavior initiated after untrusted code executes and Use Falco or eBPF runtime security to detect anomalous child process execution or unauthorized network activity inside the container. These controls limit blast radius and contain exploitation, but they do not fix the underlying unsafe class selection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1302 Deserialization Allowlist (Safe Loading) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 6.3 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | Low |
| Integrity Impact | High | N/A | Low |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic
The attacker might be able to execute code that is not directly accessible to the attacker. Alternately, the attacker could call unexpected code in the wrong place or the wrong time, possibly modifying critical system state.
Availability,Other
Technical Impact: DoS: Crash, Exit, or Restart; Other
The attacker might be able to use reflection to call the wrong code, possibly with unexpected arguments that violate the API (CWE-227). This could cause the product to exit or hang.
Confidentiality
Technical Impact: Read Application Data
By causing the wrong code to be invoked, the attacker might be able to trigger a runtime error that leaks sensitive information in the error message, such as CWE-536.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
