Unsafe Deserialization in Flash-Attention Checkpoint Loading

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-31253 exposes a critical insecure deserialization vulnerability in the flash-attention training framework's checkpoint loading mechanism. The vulnerability stems from the use of torch.load() without the weights_only=True parameter in checkpoint.py and eval.py, allowing attackers to deserialize arbitrary Python objects through pickle. This affects machine learning practitioners, researchers, and organizations using flash-attention for model training and evaluation. An attacker with the ability to supply a malicious checkpoint file can achieve remote code execution during the model loading phase, potentially compromising training infrastructure, stealing model weights, or establishing persistent access to affected systems.

Casky's 419 matched security skills leverage Claude AI's extended reasoning to identify attack patterns across MITRE ATT&CK techniques TA0001 (Reconnaissance), TA0043 (Reconnaissance—focused on supply chain), and TA0002 (Resource Development). Practitioners using Casky would detect: (1) CWE-502 patterns showing unsafe pickle deserialization calls without validation, (2) supply chain attack vectors where malicious checkpoints are injected into model repositories or shared training datasets, and (3) initial access techniques exploiting the trusted nature of checkpoint files in ML workflows. The platform's skill mapping would surface specific code patterns—torch.load() calls lacking security parameters, absence of checkpoint validation, and missing cryptographic integrity checks—enabling teams to prioritize remediation of vulnerable load paths before attackers weaponize checkpoint poisoning at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-31253.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-31253

Casky has 419 skills that investigate the attack patterns behind CVE-2026-31253. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn