Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-62239FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py

Medium 6.6

In plain English

A medium-severity security flaw in flash-attention from Dao-AILab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.2%top 94.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.

Affected products (as reported)

Vendor	Product	Versions
Dao-AILab	flash-attention	0 – through 2.8.3.post1

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/flashattention-symlink-attack-via-tarfile-extractall-in-hopper-setup-py third-party-advisory