Threats Tagged 'ghsa-5jjj-9xc3-rm56'

A high-severity vulnerability (CVE-2026-106440) exists in the hydra-ecosystem hydra framework, specifically in the hydra-optuna-sweeper package versions 1.2.0 up to but not including 1.3.0 and 1.4.0.dev4 up to but not including 1.4.0.dev10. The issue involves unsafe reflection where externally controlled input can specify a dotted path to Python code that is resolved and invoked without proper execution policy enforcement. This allows an attacker controlling Optuna sweep configuration or command-line overrides to execute arbitrary Python code with the application's privileges, bypassing trusted execution whitelists. The vulnerability is fixed in versions 1.3.0 and 1.4.0.dev10.