What is the CVSS score of CVE-2026-31253?

CVE-2026-31253 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of flash-attention are affected by CVE-2026-31253?

The flash-attention machine learning framework used by AI/ML teams contains an arbitrary code execution vulnerability in checkpoint loading that could allow attackers to compromise training…

How to fix or mitigate CVE-2026-31253?

Within 24 hours: identify all systems using flash-attention and audit checkpoint loading sources; restrict to internally-validated or cryptographically-signed models only. Within 7 days: implement checkpoint validation using signature or hash verification (SHA256); require documented provenance for all model artifacts; establish single approved checkpoint repository. Within 30 days: monitor Dao-AILab GitHub repository for security patches; evaluate PyTorch weights_only=True parameter adoption path for future flash-attention versions; document mitigations in security policies and incident response procedures.

flash-attention CVE-2026-31253

EUVD-2026-29100 HIGH

Code Injection (CWE-94)

2026-05-11 mitre

GHSA-7g5w-pq96-8c5w

RCE Python Deserialization Code Injection N A Checkpoint

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.8 HIGH

Victim must load an attacker-supplied checkpoint (UI:R), no auth needed (PR:N), and successful unpickling yields full code execution, so C/I/A are High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:05 vuln.today

CVSS changed

May 12, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on flash-attn (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.8.3.

DescriptionCVE.org

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.

AnalysisAI

Arbitrary code execution in the Dao-AILab flash-attention training framework (all revisions up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62) arises because its checkpoint-loading paths call PyTorch's torch.load() without weights_only=True, permitting pickle-based deserialization of attacker-controlled objects. Any user who warmstarts or evaluates a model from an untrusted checkpoint file triggers code execution on their host. No public exploit is identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as 'none' - this is a latent supply-chain/ML-artifact risk rather than an actively exploited one.

Technical ContextAI

The defect is a classic Python insecure-deserialization issue (CWE-502; the NVD header also tags CWE-94, Code Injection). PyTorch's torch.load() defaults to the pickle module, which reconstructs arbitrary Python objects and will invoke __reduce__/__setstate__ handlers embedded in the serialized stream - meaning loading a file is equivalent to executing whatever code its author chose. The security-hardened remedy, weights_only=True (default-safe in newer PyTorch), restricts unpickling to tensors and a small allowlist of safe types. In this framework the unsafe calls live in load_checkpoint() in checkpoint.py and in the checkpoint-loading logic of eval.py, both invoked during model warmstarting and evaluation. Because ML checkpoints are routinely shared via public hubs, mirrors, and collaborators, a poisoned .pt/.ckpt artifact is a realistic delivery vehicle. CPE data is uninformative here (cpe:2.3:a:n/a:n/a) so exact affected packaging must be taken from the GitHub source, not NVD CPE.

RemediationAI

Because the CVE identifies a specific commit boundary rather than a fixed release, no vendor-released patched version is independently confirmed at time of analysis - track the flash-attention repository (https://github.com/Dao-AILab/flash-attention) for a commit that adds weights_only=True. The concrete code-level fix is to change both torch.load() call sites - load_checkpoint() in checkpoint.py and the loader in eval.py - to pass weights_only=True (and, where custom classes are legitimately needed, use torch.serialization.add_safe_globals() to allowlist them rather than disabling the guard). As compensating controls until patched: only load checkpoints you produced or that come from a cryptographically verified source, and validate artifact integrity with checksums/signatures before loading (trade-off: operational overhead and breaks convenient hub pulls); load untrusted checkpoints only inside a sandboxed/containerized, network-restricted, non-privileged environment so any executed payload is contained (trade-off: added infra complexity); and prefer safetensors format for weight exchange where feasible (trade-off: does not carry arbitrary Python/optimizer state, so warmstarting workflows may need adjustment). Cite the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31253 and EUVD-2026-29100 in change records.