Threats Tagged 'ghsa-mwj6-rfh8-7qf4'

CVE-2026-106439 is a high-severity vulnerability in hydra-ecosystem's hydra affecting versions 1.3.4 through 1.3.6 and 1.4.0.dev4 through 1.4.0.dev9. It involves unsafe reflection where mutable module-level state used for target blocklists can be manipulated via configuration to remove blocked targets and instantiate them, bypassing intended execution restrictions. The vulnerability affects the legacy/default path without an execution whitelist and allows a configuration controlling multiple sibling _target_ entries to mutate the blocklist and invoke otherwise blocked targets. The issue is fixed in hydra-core 1.3.7 and 1.4.0.dev10. Users are advised to upgrade and avoid passing untrusted configuration to instantiate().