FlashAttention CVE-2026-62239
MEDIUMSeverity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack (AV:L) requiring low-privilege write access to cache dir (PR:L) and victim-initiated build (UI:R); high C and I for arbitrary file read/write; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.
AnalysisAI
Arbitrary file write via symlink attack in FlashAttention's build toolchain (through 2.8.3.post1) allows a local low-privileged attacker to redirect NVIDIA archive extraction to attacker-controlled paths by pre-planting a symlink in the predictable cache directory before a victim initiates a build. The hopper/setup.py download_and_copy() function called tarfile.extractall() without symlink validation or path confinement, meaning extracted NVIDIA toolchain binaries could be written anywhere accessible to the victim's process. No active exploitation is confirmed in CISA KEV, but a publicly available proof-of-concept exists at GitHub issue #2637 and a vendor patch is available in commit 0816ef1.
Technical ContextAI
FlashAttention (cpe:2.3:a:dao-ailab:flash-attention:*:*:*:*:*:*:*:*) is a GPU-accelerated attention kernel library widely used in transformer-based deep learning workloads targeting NVIDIA GPUs, including the Hopper architecture. The vulnerable code in hopper/setup.py invokes Python's tarfile.extractall() to unpack NVIDIA toolchain archives (e.g., CUDA-related tarballs) into a predictable cache path (flashattn_cache_path) during build or install. CWE-59 (Improper Link Resolution Before File Access - Link Following) is the root cause: the code resolved neither the destination directory nor individual tar members against real filesystem paths before extraction, making it susceptible to both a pre-planted directory-level symlink (redirecting the entire extraction target) and malicious in-archive symlinks (redirecting individual file writes). The fix in PR #2702 adds a safe_extractall() wrapper that uses Python 3.12+'s PEP 706 tarfile data filter where available, and on older interpreters manually validates each member's os.path.realpath() against the intended destination. It also adds a pre-extraction guard that aborts if the resolved cache path escapes the cache root or is itself a symlink.
RemediationAI
The primary fix is to update FlashAttention to a version incorporating upstream commit 0816ef12f424c6ec94b057a72c275b14f6e6edb2 (pull request #2702: https://github.com/Dao-AILab/flash-attention/pull/2702); a tagged release version incorporating this fix was not independently confirmed from available data, so verify the specific release against the commit. If immediate upgrade is not possible, restrict write permissions on the flashattn_cache_path directory to the build user only, eliminating the ability of other local users to pre-plant symlinks - this is an effective compensating control with no functional side effects for single-build-user environments. In shared CI/CD environments, running builds in isolated containers or ephemeral user contexts removes the local write-access precondition entirely. Disabling the hopper/setup.py NVIDIA toolchain download path would break Hopper GPU support and is not recommended as a mitigation unless that hardware is not in use.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today