EUVD-2026-29101
GHSA-9hgr-qwgw-x8pp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitation needs a victim to run training against an attacker-supplied config (AV:L, UI:R), but resulting arbitrary code execution yields full C/I/A on the host, unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:...} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.
AnalysisAI
Arbitrary code execution in the flash-attention project's training script (up to commit e724e2588cbe754beb97cf7c011b5e7e34119e62) allows an attacker to run Python code by supplying a malicious Hydra configuration. The script registers Python's eval() as a Hydra resolver named 'eval', so any config value using the ${eval:...} syntax is executed when a victim launches training with that configuration. No public exploit has been identified and EPSS probability is very low (0.02%), but SSVC rates the flaw as automatable with partial technical impact.
Technical ContextAI
The affected component is the training harness built on Hydra/OmegaConf, a widely used configuration framework in Python ML projects. Hydra supports custom 'resolvers' that expand ${name:args} interpolations in YAML config files at load time; here the project registered Python's built-in eval() under the resolver name 'eval', so ${eval:<expr>} evaluates arbitrary Python during config resolution. The root cause is CWE-95 (eval injection), a subclass of the CWE-94 code-injection class cited in the NVD description - note the input references both CWE-94 (description) and CWE-95 (classification), which are consistent parent/child weaknesses. CPE data is unhelpful here (recorded as cpe:2.3:a:n/a:n/a:*), so the affected product must be identified from the description rather than the CPE dictionary.
RemediationAI
No vendor-released patch version is identified in the available data, and the fix boundary is expressed only as a commit hash. The concrete remediation is to remove the dangerous resolver registration: do not register Python's eval() as a Hydra resolver, or replace it with a safe evaluator such as ast.literal_eval or a restricted arithmetic parser, then update to a project revision after commit e724e2588cbe754beb97cf7c011b5e7e34119e62. As compensating controls until code is fixed, only run the training script with configuration files from trusted sources under version control, review any third-party or downloaded config for ${eval:...} interpolations before use, and run training jobs under a low-privilege account or sandbox/container so that code execution cannot pivot to broader infrastructure. Trade-off: disabling or replacing the eval resolver will break any legitimate configs that relied on computed ${eval:...} expressions, which must be rewritten. Reference the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-31254) for tracking.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today