Hydra core versions 1.3.6 through 1.3.7 and 1.4.0.dev9 through 1.4.0rc2 have a vulnerability in the legacy target blacklist that omits unsafe PyYAML loading functions. This allows an attacker who controls the target and arguments passed to instantiate() to execute arbitrary Python code via a malicious YAML configuration. The issue affects legacy no-whitelist paths and is not a bypass of Hydra 1.4's execution whitelist. The vulnerability is fixed in versions 1.3.8 and 1.4.0rc3.