## Hydra legacy target blacklist permits unsafe PyYAML loading

- 種別: advisory
- 重大度: high
- 関連技術: python
- 公開日時: 2026-10-27T17:08:41.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-wf6j-7hvr-gr93)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-wf6j-7hvr-gr93

影響: pip:hydra-core >= 1.3.6, < 1.3.8 → 1.3.8, pip:hydra-core >= 1.4.0.dev9, < 1.4.0rc3 → 1.4.0rc3
Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate(), a target such as yaml.unsafe_load can execute Python code through a config-controlled YAML stream containing Python object-construction tags. Impact and prerequisites The attacker must control the relevant target and arguments that the application instantiates. The configured callable executes with the application's process privileges. This…