p PatchFirst

CVE-2026-31253

CVE-2026-31253

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.

CVSS 7.3 · High · EPSS 0.2%

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • flash-attn PyPI

    Versions
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6.post1
    • 0.2.7
    • 0.2.8
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.3.post0
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 2.0.0.post1
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.6.post2
    • 2.0.7
    • 2.0.8
    • 2.0.9
    • 2.1.0
    • 2.1.1
    • 2.1.2.post3
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3.post2
    • 2.2.4
    • 2.2.4.post1
    • 2.2.5
    • 2.3.0
    • 2.3.1.post1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.4.0.post1
    • 2.4.1
    • 2.4.2
    • 2.4.3.post1
    • 2.5.0
    • 2.5.1.post1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.5.5
    • 2.5.6
    • 2.5.7
    • 2.5.8
    • 2.5.9.post1
    • 2.6.0.post1
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.7.0.post2
    • 2.7.1.post4
    • 2.7.2.post1
    • 2.7.3
    • 2.7.4.post1
    • 2.8.0.post2
    • 2.8.1
    • 2.8.2
    • 2.8.3
    Affected ranges
    • ECOSYSTEM: ≤ 2.8.3

    No fix published

Original sources

Check your server →