aigco (0.0.3), airoboros (>=2.1.6, <=2.2.1) +82 more potentially affected by CVE-2026-31253 via flash-attn (>=0.2.8, <=2.8.3.post1)

flash-attn PYPI version =0.2.8, =2.1.6, =1.1.2, =0.0.0.dev0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-31253 Source advisory: SNYK:PYTHON-FLASHATTN-17670564...

CVE-2026-31253

The flash-attention training framework is vulnerable to an insecure deserialization (CWE-502) vulnerability in its checkpoint loading mechanism, specifically affecting versions prior to commit e724e2588cbe754beb97cf7c011b5e7e34119e62 . The load_checkpoint() function in checkpoint.py and the loadi...