Executive brief
Hydra is a configuration framework used in Python applications to construct objects and call functions from configuration files. When an application passes untrusted configuration to the instantiate() function, an attacker can specify arbitrary Python callables in the _target_ field and cause code execution with the privileges of the process running the application. This commonly affects AI/ML applications that load model metadata from untrusted sources.
Technical details
Hydra's instantiate API is designed to resolve and call Python objects specified in configuration using a _target_ field. The vulnerability is a code injection issue (CWE-94) combined with unsafe reflection (CWE-470): if untrusted input controls the _target_ value, an attacker can select any callable in the Python environment and provide attacker-controlled arguments. Exploitation requires a consuming application to load and pass untrusted config, CLI overrides, or model metadata directly to instantiate() without validation. Version 1.3.4 adds a blacklist of dangerous targets as defense-in-depth, but the primary mitigation is for applications to validate _target_ values against a trusted allowlist before instantiation. The unreleased version 1.4 will use an allowlist-based model by default.
Affected products
- hydra-ecosystem hydra-core <= 1.3.3
Timeline
- 2026-07-24: disclosed: Published by GitHub
- 2026-08-21: advisory: Added to GitHub Advisory Database
- 2026-08-21: patched: Version 1.3.4 released with blacklist mitigation