{"id":"CVE-2026-31253","aliases":["EUVD-2026-29100","GHSA-7g5w-pq96-8c5w","PYSEC-2026-2477"],"status":"published","title":"flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00218,"percentile":0.12437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502","CWE-94"],"published":"2026-05-11T00:00:00Z","modified":"2026-07-14T05:30:20Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flash-attn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.8.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flash-attn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.8.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6.post1","0.2.7","0.2.8","1.0.0","1.0.1","1.0.2","1.0.3","1.0.3.post0","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0.post1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.6.post2","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.2.post3","2.2.0","2.2.1","2.2.2","2.2.3.post2","2.2.4","2.2.4.post1","2.2.5","2.3.0","2.3.1.post1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.4.0.post1","2.4.1","2.4.2","2.4.3.post1","2.5.0","2.5.1.post1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9.post1","2.6.0.post1","2.6.1","2.6.2","2.6.3","2.7.0.post2","2.7.1.post4","2.7.2.post1","2.7.3","2.7.4.post1","2.8.0.post2","2.8.1","2.8.2","2.8.3"]},{"source":"osv","ecosystem":"PyPI","package":"flash-attn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.8.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6.post1","0.2.7","0.2.8","1.0.0","1.0.1","1.0.2","1.0.3","1.0.3.post0","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0.post1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.6.post2","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.2.post3","2.2.0","2.2.1","2.2.2","2.2.3.post2","2.2.4","2.2.4.post1","2.2.5","2.3.0","2.3.1.post1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.4.0.post1","2.4.1","2.4.2","2.4.3.post1","2.5.0","2.5.1.post1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9.post1","2.6.0.post1","2.6.1","2.6.2","2.6.3","2.7.0.post2","2.7.1.post4","2.7.2.post1","2.7.3","2.7.4.post1","2.8.0.post2","2.8.1","2.8.2","2.8.3"]}],"references":[{"url":"https://github.com/Dao-AILab/flash-attention","tags":["package"]},{"url":"https://www.notion.so/CVE-2026-31253-35d1e1393188813f9e77e2038104bc49","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31253","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7g5w-pq96-8c5w","tags":["advisory"]},{"url":"https://pypi.org/project/flash-attn","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-31253","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T19:32:41.02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-502","CWE-94"],"updated_at":"2026-11-02T14:19:51.277563Z"}],"euvd":[{"id":"EUVD-2026-29100","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T19:32:41Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:04:36.64757Z"}],"ghsa":[{"id":"GHSA-7g5w-pq96-8c5w","title":"flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","status":"published","published":"2026-05-11T18:31:44Z","modified":"2026-06-30T21:53:45Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-94","CWE-502"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"nvd":[{"id":"CVE-2026-31253","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","status":"published","published":"2026-05-11T17:16:20.307Z","modified":"2026-06-17T10:33:32.82Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-94","CWE-502"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"GHSA-7g5w-pq96-8c5w","title":"flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","status":"published","published":"2026-05-11T18:31:44Z","modified":"2026-07-14T05:30:20.366472231Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-502","CWE-94"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"PYSEC-2026-2477","title":"flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism","description":"The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.","status":"published","published":"2026-07-13T15:15:45.233345Z","modified":"2026-07-13T16:31:40.152625318Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}