Look, Don't Load: Model Inspection in Unsloth Studio Leads to Critical Arbitrary Code Execution

Pillar Security discovered an arbitrary-code-execution flaw in Unsloth Studio where the backend would automatically execute Python shipped inside a Hugging Face model repo when inspecting model metadata (config.json with auto_map) because trust_remote_code was enabled on the capability path; this allowed code to run with the Studio process user's privileges, risking theft of HF tokens, SSH/cloud credentials, model tampering, and lateral movement. The maintainers patched the issue in version 2026.6.9 after coordinated disclosure; users should upgrade and treat model repos requiring trust_remote_code as untrusted code that must be explicitly opted into.