TI-2026-44462 CVE-2026-62239 · GHSA-w9r7-4gwr-j959
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
Priority MEDIUM 59
FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating s…