Hydra legacy target blacklist permits unsafe PyYAML loading

影響: pip:hydra-core >= 1.3.6, < 1.3.8 → 1.3.8, pip:hydra-core >= 1.4.0.dev9, < 1.4.0rc3 → 1.4.0rc3

Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate(), a target such as yaml.unsafe_load can execute Python code through a config-controlled YAML stream containing Python object-construction tags. Impact and prerequisites The attacker must control the relevant target and arguments that the application instantiates. The configured callable executes with the application's process privileges. This…

Read on GitHub Advisory Database

On 10/28/2026, 02:08 AM, GitHub Advisory Database published "Hydra legacy target blacklist permits unsafe PyYAML loading" (type: Advisory). Severity is "High" (high). Related technologies: Python.