From 2b38a8910de55178237e4ba50c39cbc79c65a2c7 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 13 Feb 2026 11:24:57 +0000 Subject: [PATCH 1/2] fix: non-literal-import-1080 --- unsloth/import_fixes.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/unsloth/import_fixes.py b/unsloth/import_fixes.py index 4a2211f9a0..9cd7db6de5 100644 --- a/unsloth/import_fixes.py +++ b/unsloth/import_fixes.py @@ -1075,7 +1075,20 @@ def fake_supports_pdl(*args, **kwargs): "lora_shrink_op": "vllm.lora.ops.triton_ops.lora_shrink_op", "fused_moe_lora_op": "vllm.lora.ops.triton_ops.fused_moe_lora_op", } + + # Whitelist of allowed module paths to prevent arbitrary code execution + allowed_modules = { + "vllm.lora.ops.triton_ops.lora_expand_op", + "vllm.lora.ops.triton_ops.lora_shrink_op", + "vllm.lora.ops.triton_ops.fused_moe_lora_op", + } + for name, path in consumer_modules.items(): + # Validate module path against whitelist before importing + if path not in allowed_modules: + logger.warning(f"Unsloth: Skipping import of non-whitelisted module: {path}") + continue + try: module = importlib.import_module(path) if hasattr(module, "supports_pdl"): From 59decb3641a4a7b4dccef638f9642e61dbda6532 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Fri, 13 Feb 2026 11:25:46 +0000 Subject: [PATCH 2/2] [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --- unsloth/import_fixes.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/unsloth/import_fixes.py b/unsloth/import_fixes.py index 9cd7db6de5..5a1ab70816 100644 --- a/unsloth/import_fixes.py +++ b/unsloth/import_fixes.py @@ -1075,20 +1075,22 @@ def fake_supports_pdl(*args, **kwargs): "lora_shrink_op": "vllm.lora.ops.triton_ops.lora_shrink_op", "fused_moe_lora_op": "vllm.lora.ops.triton_ops.fused_moe_lora_op", } - + # Whitelist of allowed module paths to prevent arbitrary code execution allowed_modules = { "vllm.lora.ops.triton_ops.lora_expand_op", - "vllm.lora.ops.triton_ops.lora_shrink_op", + "vllm.lora.ops.triton_ops.lora_shrink_op", "vllm.lora.ops.triton_ops.fused_moe_lora_op", } - + for name, path in consumer_modules.items(): # Validate module path against whitelist before importing if path not in allowed_modules: - logger.warning(f"Unsloth: Skipping import of non-whitelisted module: {path}") + logger.warning( + f"Unsloth: Skipping import of non-whitelisted module: {path}" + ) continue - + try: module = importlib.import_module(path) if hasattr(module, "supports_pdl"):