CVE-2026-112075
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-10-19 04:17:09.287000
Last modified
2026-10-19 17:17:10.637000
View original CVE JSON
{
"id": "CVE-2026-112075",
"sourceIdentifier": "[email protected]",
"published": "2026-10-19T04:17:09.287",
"lastModified": "2026-10-19T17:17:10.637",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.1.902-beta is able to mitigate this issue. Patch name: de801746386a53a0cb26216e715a0af863b76ad9. The affected component should be upgraded."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "unslothai",
"product": "unsloth",
"cpes": [
"cpe:2.3:a:unslothai:unsloth:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "0.1.501-beta",
"status": "affected"
},
{
"version": "0.1.902-beta",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-19T15:46:35.739324Z",
"id": "CVE-2026-112075",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-470"
}
]
}
],
"references": [
{
"url": "https://github.com/unslothai/unsloth/",
"source": "[email protected]"
},
{
"url": "https://github.com/unslothai/unsloth/commit/de801746386a53a0cb26216e715a0af863b76ad9",
"source": "[email protected]"
},
{
"url": "https://github.com/unslothai/unsloth/issues/12419",
"source": "[email protected]"
},
{
"url": "https://github.com/unslothai/unsloth/pull/11560",
"source": "[email protected]"
},
{
"url": "https://github.com/unslothai/unsloth/releases/tag/v0.1.902-beta",
"source": "[email protected]"
},
{
"url": "https://github.com/user-attachments/files/32908312/poc.zip",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-112075",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1009576",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/421754",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/421754/cti",
"source": "[email protected]"
}
]
}