Skip to main content

FlashAttention CVE-2026-62239

MEDIUM
Improper Link Resolution Before File Access (CWE-59)
2026-07-13 VulnCheck
Nvidia Information Disclosure Flash Attention
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.6 MEDIUM

Local attack (AV:L) requiring low-privilege write access to cache dir (PR:L) and victim-initiated build (UI:R); high C and I for arbitrary file read/write; no availability impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 13, 2026 - 21:46 vuln.today
Analysis Generated
Jul 13, 2026 - 21:46 vuln.today
CVE Published
Jul 13, 2026 - 21:03 cve.org
MEDIUM 5.3

DescriptionCVE.org

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.

AnalysisAI

Arbitrary file write via symlink attack in FlashAttention's build toolchain (through 2.8.3.post1) allows a local low-privileged attacker to redirect NVIDIA archive extraction to attacker-controlled paths by pre-planting a symlink in the predictable cache directory before a victim initiates a build. The hopper/setup.py download_and_copy() function called tarfile.extractall() without symlink validation or path confinement, meaning extracted NVIDIA toolchain binaries could be written anywhere accessible to the victim's process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain low-privilege local access to shared build system
Delivery
Identify predictable FlashAttention cache directory
Exploit
Pre-plant symlink redirecting extraction path to sensitive location
Execution
Victim initiates FlashAttention Hopper build
Persist
download_and_copy() calls extractall() through planted symlink
Impact
Extracted NVIDIA toolchain files written to attacker-chosen path with victim privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two specific conditions: (1) the attacker must have local write access to the flashattn_cache_path directory - the predictable cache location used by FlashAttention's hopper/setup.py - in order to pre-plant a symlink before the build runs; and (2) a victim user with higher or more sensitive filesystem privileges must subsequently trigger a FlashAttention build or installation that invokes download_and_copy() for NVIDIA Hopper GPU support. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) accurately characterizes this as a local, low-privilege attack constrained by two conditions: AT:P (the attacker must successfully pre-plant a symlink before the build runs) and UI:P (a victim must passively initiate the build). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario On a shared GPU build server, a low-privileged attacker identifies the predictable FlashAttention cache directory and places a symlink at the expected extraction subdirectory path, redirecting it to a sensitive writable location such as a cron directory or an authorized SSH key file. When a developer or CI/CD job subsequently runs a FlashAttention build targeting NVIDIA Hopper GPUs, download_and_copy() extracts the NVIDIA toolchain archive through the attacker's symlink, writing extracted binaries to the redirected path with the victim's privileges. …
Remediation The primary fix is to update FlashAttention to a version incorporating upstream commit 0816ef12f424c6ec94b057a72c275b14f6e6edb2 (pull request #2702: https://github.com/Dao-AILab/flash-attention/pull/2702); a tagged release version incorporating this fix was not independently confirmed from available data, so verify the specific release against the commit. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2015-1130 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8
CVE-2024-57728 HIGH POC
7.2
CVE-2025-21391 HIGH
7.1
CVE-2025-48384 HIGH
8.0
CVE-2024-28189 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-62239 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy