CVE-2026-68508High· 7.8▾ TwilightHydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instanti…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.5%
Last analysed / modified upstream
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
hydra-core <= 1.3.3Patched in:
hydra-core 1.3.4Source: https://github.com/advisories/GHSA-2cp2-2r3c-7p7r
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106441High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-106439High· 8.5Hydra is a framework for elegantly configuring complex applications
CVE-2026-106442High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-58659High· 7.8PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters…
GHSA-wf6j-7hvr-gr93High· 7.8Hydra legacy target blacklist permits unsafe PyYAML loading
CVE-2026-105782High· 7.5Scrapy is a high-level web crawling and scraping framework for Python