{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-AUR-2026-005950","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-04T07:51:03Z","dateUpdated":"2026-11-04T07:51:03Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"The Arch User Repository (AUR) package `python-unsloth` was flagged as malicious by automated PKGBUILD analysis (2 indicator(s)). Building or installing this package may execute attacker-controlled code. This verdict is produced by static analysis and is subject to human review.","supportingMedia":null},{"lang":"en","value":"[T-DIFF-SOURCE-DOMAIN-CHANGED] Source URLs changed to new domain(s): codeload.github.com, github.com, raw.githubusercontent.com","supportingMedia":null},{"lang":"en","value":"[SA-HIGH-ENTROPY-HEREDOC] heredoc with high entropy (5.2 bits/byte, 2236 bytes)","supportingMedia":null}],"references":[{"url":"https://aur.archlinux.org/packages/python-unsloth","name":"","tags":["advisory"]},{"url":"https://github.com/unslothai/unsloth","name":"","tags":["web"]},{"url":"https://github.com/unslothai/unsloth/archive/bbee0dc04fb3c3c8485fc02c0e88da48d2c4dc7b.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/dagrejs/dagre/archive/a7c0bd1c0edf89c53c3efd05557c9920289d2fd2.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/iamkun/dayjs/archive/4549b8d03307891143e8a50d39fcdab1f16f77cf.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/dexie/Dexie.js/archive/ab489deaa7434c549c32225d03ec1e30cacb10c4.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/Stuk/jszip/archive/0f2f1e4d0509514417db83fe5b86bde90e0ffe8d.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/KaTeX/KaTeX/archive/878a61be7743a8ec4ee725b0b5efa810b5167c79.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/pshihn/rough/archive/56a2762171b1294d643501e8d14f120db6b27bd7.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/vercel/streamdown/archive/15ba1aee86ab053ada83326f563e78b4d2c7f4f7.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/unjs/unpdf/archive/0b841e45b7bee27cfb6b0738cafdd85f6ae58d48.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/mozilla/pdf.js/archive/f56dc86014bb00c5a239680df53d2010e9aad0f8.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/mozilla/pdf.js/archive/ada343803945d977b9a1be8e72184b0422f8e5d1.tar.gz","name":"","tags":["web"]},{"url":"https://github.com/vercel/streamdown/archive/8a2ac221a878a0fc5839f2035c1e16575cfa3440.tar.gz","name":"","tags":["web"]},{"url":"https://codeload.github.com/swagger-api/swagger-ui/tar.gz/30d8f985caeca5bb9400cf21403686ec5a82c1cc","name":"","tags":["web"]},{"url":"https://codeload.github.com/Redocly/redoc/tar.gz/d140213cb6a977cc7376d15e308f0cd63498ed56","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/radix-ui/primitives/fcef0668a5c827e5a4baac405474d75680f9a4eb/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/remarkjs/remark-math/88a9497e1ede93b958237c85edbf5651faeca7af/license","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/FormidableLabs/victory/d9d9ca2d5038d6ef9de91f2cef39e6fb2733baa6/LICENSE.txt","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/kazuhikoarase/qrcode-generator/83b7e8fe3fddd3b0368dbafd6ce56995bd25e3c8/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/remarkjs/remark-math/d5d0660b150810a535bbb07eac6cc96a4510aa24/license","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/theKashey/react-remove-scroll-bar/7301c160fda44cb8cf2b9fdfde61efad35736196/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/MIT.txt","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/BSD-2-Clause.txt","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/styled-components/styled-components/4f54d97af2a05e571b357e2806697e479af065a0/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/Apache-2.0.txt","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/CC0-1.0.txt","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/Redocly/workerize-loader/6897b3fa5784c8f4970c81e04dbc8025f3c60938/README.md","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/samsonjs/format/4f898096759776b7c84fa7a25b13c923dadfe46e/Readme.md","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/LestaD/license.js/f921751cb8d7f82f6abfe0551c72353f49982748/licenses/MIT.txt","name":"","tags":["web"]},{"url":"https://codeload.github.com/oxc-project/oxc/tar.gz/73e6b564737a29ecebf428d276421dcc492836df","name":"","tags":["web"]},{"url":"https://codeload.github.com/oxc-project/oxc/tar.gz/07ed78f4abde4020ca7919381ffea4da8616b78a","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/oxc-project/nodejs-built-in-modules/9117efa38fe088325e8a1036a8ddea7f3546c1ac/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/licenses/serde_json/LICENSE-MIT","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/napi-rs/napi-rs/8bab46ee5dfd48a7b51e8bad3d09aed315ada4df/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/licenses/LICENSE-sonic_cpp","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/oxc-project/javascript-globals/a3888aa28f1312f80df0b8e5cb885106277e490e/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/licenses/LICENSE-rust","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/licenses/LICENSE-simdjson","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/oxc-project/oxc-browserslist/a9b49a18042671c91811dc1074e01b9c08331327/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/Nugine/simd/d74c030d9dc4f3cae02146d1f497ff62726ef09a/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/licenses/LICENSE-yyjson","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/oxc-project/fast-glob/3b6c31c39a676257fd1d95c338025b64f3f0395a/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/Canop/lazy-regex/39a459c01e1ba2488075be50a821e2d72e466241/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/oxc-project/oxc-index-vec/8e09fe324eb6df02f56e4eacdfac958930300380/LICENSE","name":"","tags":["web"]},{"url":"https://raw.githubusercontent.com/cloudwego/sonic-rs/41ae6e8a5962da26eab34432d1412f35ea6d199e/licenses/LICENSE-sonic","name":"","tags":["web"]}],"metrics":null,"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"aur","product":"python-unsloth","collectionURL":"https://aur.archlinux.org","packageName":"python-unsloth","repo":"","defaultStatus":"","versions":[{"version":"2026.11.1-1","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}