CVE-2026-31254 — Hydra ${eval:...} code execution via custom resolver in FlashAttention run.py

MITRE service request: 1988723

Status: RESERVED (pending a qualifying public reference per CNA Rules §5.3).

Official CVE description

The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:…} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.

Summary

OmegaConf.register_new_resolver('eval', eval) exposes raw Python evaluation inside YAML/structured configs. Any untrusted .yaml passed to training/run.py can embed ${eval:...} expressions that invoke arbitrary Python (for example importing os and calling system), executed at Hydra initialization.

Affected product and versions

• Product: Dao-AILab/flash-attention.
• Known vulnerable commit (coordination record): e724e2588cbe754beb97cf7c011b5e7e34119e62.

Technical details

• Surface: @hydra.main decorated entry loading attacker-controlled YAML.
• Sink: Resolver named eval mapped to built-in eval.
• Impact: RCE before training loop begins; trivial to hide inside benign-looking keys.
• Mitigation: Remove resolver; use oc.decode with strict schema.

Risk

Critical — config-driven RCE is trivial to weaponize in CI.

Remediation / workaround

• Never run Hydra with third-party configs unchecked; vendor patch TBD.

CVE Program next steps