{"id":"CVE-2026-62239","title":"FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filter…","summary":"FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filter…","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-59"],"vendor":"Dao-AILab","product":"flash-attention","affected":["flash-attention <= 2.8.3.post1"],"published":"2026-07-13","updated":"2026-09-17","sourceUpdated":"2026-09-17T18:16:56.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62239","references":[{"url":"https://github.com/Dao-AILab/flash-attention/commit/0816ef12f424c6ec94b057a72c275b14f6e6edb2","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Dao-AILab/flash-attention/issues/2637","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Dao-AILab/flash-attention/pull/2702","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flashattention-symlink-attack-via-tarfile-extractall-in-hopper-setup-py","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Dao-AILab/flash-attention/issues/2637","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-07-14T12:53:41.369813Z"},"epss":0.00194,"epssPercentile":0.09393,"ingestedAt":"2026-09-17T18:25:15.976Z","slug":"CVE-2026-62239","body":"## Overview\n\nFlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":36.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}