Vulnerabilities

TI-2026-79750 CVE-2026-115749 · GHSA-7vmw-xf27-46r9

Arbitrary module import in hydra-ray-launcher

LOW 21

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module().

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.0022 Published 2026-10-23 Fixed in 1.2.2, 1.4.0rc2 CWE-470

TI-2026-68894 CVE-2026-106442 · GHSA-rqx7-p7vv-w7hr

Hydra instantiate() blacklist bypass allows code execution

LOW 35

Hydra is a framework for elegantly configuring complex applications.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00161 Published 2026-10-06 Fixed in 1.3.6, 1.4.0.dev9 CWE-184

TI-2026-68893 CVE-2026-106441 · GHSA-c3wx-c55w-pxjq

Hydra logging configuration lets attackers invoke importable classes

LOW 35

Hydra is a framework for elegantly configuring complex applications.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00165 Published 2026-10-06 Fixed in 1.3.6, 1.4.0.dev9 CWE-94

TI-2026-68892 CVE-2026-106440 · GHSA-5jjj-9xc3-rm56

Hydra Optuna sweeper executes untrusted callables from configuration

LOW 36

Hydra is a framework for elegantly configuring complex applications.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00271 Published 2026-10-06 Fixed in 1.3.0, 1.4.0.dev10 CWE-470

TI-2026-68891 CVE-2026-106439 · GHSA-mwj6-rfh8-7qf4

Mutable policy state in Hydra allows blocklist bypass

HIGH 72

Hydra is a framework for elegantly configuring complex applications.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00457 Published 2026-10-06 Fixed in 1.3.7, 1.4.0.dev10 CWE-470

Vulnerabilities

Filters

Arbitrary module import in hydra-ray-launcher

Hydra instantiate() blacklist bypass allows code execution

Hydra logging configuration lets attackers invoke importable classes

Hydra Optuna sweeper executes untrusted callables from configuration

Mutable policy state in Hydra allows blocklist bypass