CVE-2026-31254

Insecure 'eval' resolver in Hydra config allows arbitrary code execution.

• CVSS 7.3
• CWE-95
• Input Validation and Sanitization
• Local

The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script. The script registers the Python eval() function as a Hydra configuration resolver under the name eval. This allows configuration files to execute arbitrary Python code via the ${eval:…} syntax. An attacker can exploit this by providing a malicious configuration file, leading to arbitrary code execution when the training script is run with that configuration.

CVE

CVE-2026-31254

CWE

CWE-95

CVSS base score

7.3

Published

2026-05-11

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Interface

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

flash-attent

Fixed by upgrading

Yes

Solution

Upgrade flash-attention to version 2.5.5 or later.

import hydra
from omegaconf import DictConfig, OmegaConf

# The vulnerability is the registration of the built-in eval function as a resolver.
# This allows a configuration file to execute arbitrary code via ${eval:...}
OmegaConf.register_new_resolver("eval", eval)

@hydra.main(config_path="conf", config_name="config", version_base=None)
def train(cfg: DictConfig) -> None:
    """
    A mock training function that uses the Hydra configuration.
    The vulnerability is triggered by Hydra when it loads and resolves
    the configuration object, which happens before this function is called.
    """
    print("Training script started.")
    print("Configuration:")
    # Printing the config ensures all resolvers are executed
    print(OmegaConf.to_yaml(cfg))
    print("Training script finished.")

if __name__ == "__main__":
    train()

import hydra
from omegaconf import DictConfig, OmegaConf

# The fix is the removal of the following vulnerable line:
# OmegaConf.register_new_resolver("eval", eval)

@hydra.main(version_base=None, config_path=".", config_name="config")
def secure_training_script(cfg: DictConfig) -> None:
    """
    Main application entry point.
    By not registering the 'eval' resolver, loading a malicious config
    like '${eval:"__import__('os').system('echo pwned')}"'
    will now raise an OmegaConf.UnsupportedInterpolationType error instead
    of executing the code.
    """
    print("Configuration loaded successfully and safely.")
    print(OmegaConf.to_yaml(cfg))
    # ... training logic would follow

if __name__ == "__main__":
    secure_training_script()

trigger: ${eval:__import__('os').system('touch /tmp/pwned')}

@misc{vaitp:cve202631254,
  title        = {{Insecure 'eval' resolver in Hydra config allows arbitrary code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-31254},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-31254/}}
}