PYSEC-2026-2477

Vulnerability from pysec - Published: 2026-07-13 15:15 - Updated: 2026-07-13 16:04
VLAI
Details

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Impacted products
Name purl
flash-attn pkg:pypi/flash-attn
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "flash-attn",
        "purl": "pkg:pypi/flash-attn"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6.post1",
        "0.2.7",
        "0.2.8",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.3.post0",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.0.8",
        "1.0.9",
        "2.0.0.post1",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.0.6.post2",
        "2.0.7",
        "2.0.8",
        "2.0.9",
        "2.1.0",
        "2.1.1",
        "2.1.2.post3",
        "2.2.0",
        "2.2.1",
        "2.2.2",
        "2.2.3.post2",
        "2.2.4",
        "2.2.4.post1",
        "2.2.5",
        "2.3.0",
        "2.3.1.post1",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.4.0.post1",
        "2.4.1",
        "2.4.2",
        "2.4.3.post1",
        "2.5.0",
        "2.5.1.post1",
        "2.5.2",
        "2.5.3",
        "2.5.4",
        "2.5.5",
        "2.5.6",
        "2.5.7",
        "2.5.8",
        "2.5.9.post1",
        "2.6.0.post1",
        "2.6.1",
        "2.6.2",
        "2.6.3",
        "2.7.0.post2",
        "2.7.1.post4",
        "2.7.2.post1",
        "2.7.3",
        "2.7.4.post1",
        "2.8.0.post2",
        "2.8.1",
        "2.8.2",
        "2.8.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31253",
    "GHSA-7g5w-pq96-8c5w"
  ],
  "details": "The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim\u0027s system.",
  "id": "PYSEC-2026-2477",
  "modified": "2026-07-13T16:04:03.490636Z",
  "published": "2026-07-13T15:15:45.233345Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31253"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Dao-AILab/flash-attention"
    },
    {
      "type": "WEB",
      "url": "https://www.notion.so/CVE-2026-31253-35d1e1393188813f9e77e2038104bc49"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/flash-attn"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-7g5w-pq96-8c5w"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.