CVE-2026-31254

The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains a code injection vulnerability CWE-94 in its training script. The script registers the Python eval function as a Hydra configuration resolver under the name eval. This allows configuration files t...

CVE-2026-31254

The flash-attention project contains a code injection vulnerability (CWE-94) in its training script, specifically affecting versions through commit e724e2588cbe754beb97cf7c011b5e7e34119e62 . The vulnerability occurs because the script registers the Python eval() function as a Hydra configuration ...