Hydra-ecosystem vulnerabilities
We track 4 vulnerabilities in Hydra-ecosystem products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 6, 2026.
Latest Hydra-ecosystem vulnerabilities
- 7.8 High severity
hydra: Incomplete List of Disallowed Inputs
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrap
- 7.8 High severity
hydra: Improper Control of Generation of Code
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, ha
- 7.8 High severity
hydra: Use of Externally-Controlled Input to Select Classes or Code
Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_
- 8.5 High severity
hydra: Use of Externally-Controlled Input to Select Classes or Code
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls mult