The flash-attention training framework contains an insecure deserialization vulnerability (CWE-502) introduced in commit e724e2588cbe754beb97cf7c011b5e7e34119e62 dated 2025-13-04. The vulnerability exists in the checkpoint loading mechanism where torch.load() is called without the weights_only=True parameter, enabling deserialization of arbitrary Python objects via pickle. This allows an attacker to execute arbitrary code by providing a malicious checkpoint file that is loaded by the victim during model warmstarting or evaluation. The vulnerability is identified as CVE-2026-31253 and was published on 2026-05-11. No CVSS score or remediation details are currently available.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the victim's system by tricking them into loading a malicious checkpoint file. This can lead to full system compromise depending on the privileges of the process loading the checkpoint. There are no known exploits in the wild, but the impact of arbitrary code execution is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading checkpoint files from untrusted or unauthenticated sources. Applying the weights_only=True parameter in torch.load() calls when loading checkpoints can mitigate the risk by restricting deserialization to tensor weights only.