THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-62239 (MEDIUM 6.6) — FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-p

[NVD] CVE-2026-62239 (MEDIUM 6.6) — FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-p

lownvdPublished 2026-07-13

CVE-2026-62239 CVSS: 6.6 MEDIUM Published: 2026-07-13T22:16:51.967

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-62239