Threats Tagged 'ghsa-c3wx-c55w-pxjq'

CVE-2026-106441 is a high-severity code injection vulnerability in the hydra-ecosystem hydra project. The issue arises because Hydra passed its Python logging configuration directly to logging.config.dictConfig() without applying its target policy, allowing resolution and invocation of arbitrary importable classes and factories. This flaw enables an attacker who can control the logging configuration to execute arbitrary code with the application's privileges during logging setup. The vulnerability affects Hydra versions before 1.3.6 and prerelease versions from 1.4.0.dev0 up to but not including 1.4.0.dev9. Hydra 1.3.6 and later apply a hardened blacklist, and 1.4.0.dev9 and later introduce an execution whitelist to control callable invocation securely. Users are advised to upgrade to 1.3.6 or 1.4.0.dev9 or later and avoid composing logging configurations from untrusted sources.