{"id":"CVE-2026-31254","aliases":["EUVD-2026-29101","GHSA-9hgr-qwgw-x8pp"],"status":"published","title":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04)...","description":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:...} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00247,"percentile":0.16089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-95"],"published":"2026-05-11T00:00:00Z","modified":"2026-06-17T10:33:32Z","references":[{"url":"https://www.notion.so/CVE-2026-31254-35d1e139318881a19003f0d635ff00df"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31254"},{"url":"https://github.com/advisories/GHSA-9hgr-qwgw-x8pp"}],"sources":{"cve":[{"id":"CVE-2026-31254","description":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:...} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T18:59:01.836Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-29101","description":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:...} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T18:59:01Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:04:36.64757Z"}],"ghsa":[{"id":"GHSA-9hgr-qwgw-x8pp","title":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04)...","description":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:...} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.","status":"published","published":"2026-05-11T18:31:44Z","modified":"2026-05-12T21:32:37Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:08:07.151918Z"}],"nvd":[{"id":"CVE-2026-31254","description":"The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:...} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.","status":"published","published":"2026-05-11T17:16:20.423Z","modified":"2026-06-17T10:33:32.97Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:12:18.239974Z"}]}}