{"id":"ghsa-ghsa-wf6j-7hvr-gr93","seq":1708770,"kind":"advisory","title":"Hydra legacy target blacklist permits unsafe PyYAML loading","url":"https://github.com/advisories/GHSA-wf6j-7hvr-gr93","permalink":"https://vulnpulse.app/items/ghsa-ghsa-wf6j-7hvr-gr93","summary":"影響: pip:hydra-core >= 1.3.6, < 1.3.8 → 1.3.8, pip:hydra-core >= 1.4.0.dev9, < 1.4.0rc3 → 1.4.0rc3\nHydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate(), a target such as yaml.unsafe_load can execute Python code through a config-controlled YAML stream containing Python object-construction tags. Impact and prerequisites The attacker must control the relevant target and arguments that the application instantiates. The configured callable executes with the application's process privileges. This…","severity":"high","techs":["python"],"cves":[],"tags":["GHSA-wf6j-7hvr-gr93","hydra-core","hydra-core"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T17:08:41.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}