CVE-2026-31254 Overview
CVE-2026-31254 is a code injection vulnerability [CWE-94] in the flash-attention project up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62. The training script registers Python's built-in eval() function as a Hydra configuration resolver under the name eval. This registration allows any configuration file to execute arbitrary Python code through the ${eval:...} interpolation syntax. An attacker who supplies a malicious configuration file achieves arbitrary code execution when a user runs the training script with that configuration.
Critical Impact
Attackers can execute arbitrary Python code on machine learning training infrastructure by tricking users into loading a crafted Hydra configuration file.
Affected Products
- flash-attention project source repository through commit e724e2588cbe754beb97cf7c011b5e7e34119e62
- Training scripts that register Python eval() as a Hydra OmegaConf resolver
- Downstream forks and derivative projects that reuse the vulnerable training configuration
Discovery Timeline
- 2026-05-11 - CVE-2026-31254 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-31254
Vulnerability Analysis
The flash-attention training script integrates with Hydra and OmegaConf for configuration management. During initialization, the script calls OmegaConf.register_new_resolver("eval", eval), exposing Python's native eval() builtin as a configuration resolver. Hydra resolvers evaluate at configuration load time using the ${resolver:argument} interpolation syntax. Any string passed inside ${eval:...} is executed by the Python interpreter with the privileges of the user running the training job.
Machine learning workloads typically run with broad filesystem access, GPU device access, and network access to dataset stores and model registries. Arbitrary code execution in this context can exfiltrate training data, poison model weights, install persistence, or pivot into cloud credentials mounted on the training host.
Root Cause
The root cause is unsafe binding of eval() to a configuration interpolation primitive. Hydra resolvers are intended for safe value transformations such as arithmetic on integers or string formatting. Registering eval directly turns configuration data into executable code and removes the trust boundary between configuration files and program logic.
Attack Vector
An attacker delivers a malicious YAML or .hydra configuration file through a pull request, a shared experiment repository, a public model card, or a community fine-tuning template. When a victim runs the training entry point with --config-path or --config-name pointing to the attacker-controlled file, OmegaConf resolves the ${eval:...} expression and executes the embedded Python payload. No authentication or user interaction beyond loading the configuration is required at runtime.
A representative malicious configuration entry takes the form key: ${eval:'__import__("os").system("...")'}. See the CVE-2026-31254 reference details for additional context.
Detection Methods for CVE-2026-31254
Indicators of Compromise
- Hydra or OmegaConf configuration files containing the ${eval: interpolation token, especially with calls to __import__, os.system, subprocess, or socket
- Unexpected child processes spawned from python training entry points such as shells, package managers, or network utilities
- Outbound network connections from training nodes to non-dataset, non-registry destinations during configuration parsing
Detection Strategies
- Perform static scanning of all repository YAML and configuration files for the string ${eval: and flag matches for review
- Audit Python source for OmegaConf.register_new_resolver("eval", eval) or equivalent registrations binding eval, exec, or compile to resolver names
- Hook process creation telemetry on ML training hosts to alert when python processes running training scripts spawn shells or network tools
Monitoring Recommendations
- Log all Hydra configuration loads with the resolved configuration tree to a central data lake for retrospective review
- Monitor egress traffic from GPU training nodes and baseline expected destinations such as object storage and model registries
- Track changes to training scripts in version control and require review for any new resolver registrations
How to Mitigate CVE-2026-31254
Immediate Actions Required
- Remove the OmegaConf.register_new_resolver("eval", eval) call from any local copy or fork of the flash-attention training script
- Audit all Hydra configuration files in use for ${eval:...} expressions and refuse to load any configuration containing them
- Restrict who can submit configuration files to training pipelines and require code review for configuration changes
Patch Information
No vendor patch is referenced in the published advisory at the time of writing. Users should track the upstream flash-attention repository for a commit that removes the unsafe resolver registration or replaces it with a constrained arithmetic evaluator. Refer to the CVE-2026-31254 reference details for updates.
Workarounds
- Replace the eval resolver with a safe alternative such as ast.literal_eval wrapped in a custom resolver that only accepts numeric or literal expressions
- Run training jobs in isolated containers with no access to long-lived cloud credentials, secrets, or production datasets
- Treat third-party configuration files as untrusted input and validate them against an allowlist schema before loading
- Pin the flash-attention dependency to a reviewed commit and prohibit ad-hoc updates from forks
# Configuration example: scan a repository for the vulnerable interpolation pattern
grep -RIn --include='*.yaml' --include='*.yml' --include='*.hydra' '\${eval:' .
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
