The flash-attention training framework contains an insecure deserialization vulnerability (CWE-502) due to unsafe use of torch.load() in checkpoint.py and eval.py. Specifically, the load_checkpoint() function loads checkpoint files without enabling the weights_only=True parameter, which would restrict deserialization to tensor weights only. This improper use allows arbitrary Python objects to be deserialized via the pickle module, enabling remote code execution if a malicious checkpoint file is loaded. The vulnerability is identified as CVE-2026-31253 with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker who can supply a malicious checkpoint file to a victim using the vulnerable flash-attention training framework can achieve arbitrary code execution on the victim's system during checkpoint loading. This compromises the confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading checkpoint files from untrusted or unauthenticated sources. Applying the weights_only=True parameter in torch.load() when loading checkpoints is a recommended security practice to prevent arbitrary code execution via deserialization.