CVE-2026-31253: The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an ins

The flash-attention training framework has a vulnerability in how it loads saved model checkpoints (snapshots of a model's learned weights). An attacker can hide malicious code inside a checkpoint file, and when someone loads that file using the `load_checkpoint()` function, the code runs automatically on their computer without permission.