PT-2026-39638 · Unknown · Flash-Attention

CVE-2026-31253 · Published 2026-05-11 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions flash-attention training framework versions prior to commit e724e2588cbe754beb97cf7c011b5e7e34119e62

Description An insecure deserialization issue exists in the checkpoint loading mechanism. The load checkpoint() function in checkpoint.py and the loading code in eval.py utilize torch.load() without the weights only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module, enabling arbitrary code execution on a system when a maliciously crafted checkpoint file is loaded during model warmstarting or evaluation.

Recommendations Update to a version following commit e724e2588cbe754beb97cf7c011b5e7e34119e62. As a temporary workaround, restrict the loading of checkpoint files to trusted sources only.

Fix

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

CVE-2026-31253

GHSA-7G5W-PQ96-8C5W

PYSEC-2026-2477

Affected Products

Flash-Attention

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-31253 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2477 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g5w-pq96-8c5w · Vendor Advisory
• https://github.com/Dao-AILab/flash-attention · Note
• https://pypi.org/project/flash-attn · Note
• https://notion.so/CVE-2026-31253-35d1e1393188813f9e77e2038104bc49 · Note
• https://twitter.com/CVEnew/status/2053954546909536440 · Twitter Post
• https://github.com/advisories/GHSA-7g5w-pq96-8c5w · Note