Junglewise Threat Intelligence

CVE-2026-62239: Dao-AILab FlashAttention symlink attack in hopper setup script

CVE-2026-62239 · Severity: medium · CVSS 6.6 · Published 2026-07-13

Executive brief

FlashAttention is a library used to speed up machine learning models. A security flaw in its installation script allows a local attacker to trick the system into writing files to unintended locations by placing a symbolic link in a predictable temporary folder. This could allow an attacker to overwrite critical system files or binaries with the privileges of the user building the software, potentially leading to a full system compromise.

Technical details

A symlink attack vulnerability (CWE-59) exists in FlashAttention's 'hopper/setup.py' within the 'download_and_copy()' function. The script uses 'tarfile.extractall()' on NVIDIA toolchain archives into a predictable cache directory (~/.flashattn/nvidia/) without validating symlinks or filtering tar members. A local attacker can exploit this by pre-planting a symbolic link in the cache directory, causing the build process to write extracted binaries to an arbitrary location outside the intended directory. This enables arbitrary file writes with the privileges of the user executing the build. The issue is fixed in commit 0816ef1 by implementing a safe extraction wrapper that utilizes PEP 706 data filters or manual path validation.

Affected products

  • Dao-AILab flash-attention <= 2.8.3.post1

Timeline

  • 2026-07-11: disclosed: Issue reported via GitHub issue #2637
  • 2026-07-12: patched: Fix merged in commit 0816ef1
  • 2026-07-13: advisory: CVE-2026-62239 published

References