FlashAttention versions through 2.8.3.post1 contain a vulnerability in the download_and_copy() function within hopper/setup.py. This function extracts NVIDIA toolchain archives but fails to validate symbolic links or filter tar archive members properly. As a result, a local attacker can create a symlink in a predictable cache directory before extraction, causing the extraction process to overwrite arbitrary files chosen by the attacker with the victim's privileges. This improper link resolution before file access (link following) can lead to arbitrary file write during build time. The vulnerability was fixed in a commit identified as 0816ef1, but no patch link or official remediation level is currently documented. The CVSS 4.0 vector indicates local attack vector, low attack complexity, partial privileges required, partial user interaction, and high impact on confidentiality and integrity.

The vulnerability allows a local attacker to perform arbitrary file writes with the privileges of the victim user during the build process by exploiting symlink handling flaws in archive extraction. This can lead to modification or replacement of critical files, potentially compromising the integrity of the build environment or enabling further attacks. There is no indication of remote exploitation or privilege escalation beyond the victim's privileges. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in a commit (0816ef1), but no official patch or update release information is provided. Until an official fix is available, avoid running the vulnerable extraction process in untrusted or shared environments, and consider manually verifying or sanitizing archive contents before extraction to prevent symlink attacks.