PT-2026-39639 · Unknown · Flash-Attention

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-31254

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions flash-attention versions prior to commit e724e2588cbe754beb97cf7c011b5e7e34119e62

Description A code injection issue exists in the training script. The script registers the Python eval() function as a Hydra configuration resolver named eval, which allows configuration files to execute arbitrary Python code using the ${eval:...} syntax. An attacker can achieve arbitrary code execution by providing a malicious configuration file that is then processed by the training script.

Recommendations Update to a version beyond commit e724e2588cbe754beb97cf7c011b5e7e34119e62.

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-31254

Affected Products

Flash-Attention

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31254 · Security Note
• https://twitter.com/infoflowcloud/status/2053956019596706109 · Twitter Post
• https://twitter.com/CVEnew/status/2053954547886817568 · Twitter Post
• https://notion.so/CVE-2026-31254-35d1e139318881a19003f0d635ff00df · Note