Hydra legacy target blacklist permits unsafe PyYAML loading

影響: pip:hydra-core >= 1.3.6, < 1.3.8 → 1.3.8, pip:hydra-core >= 1.4.0.dev9, < 1.4.0rc3 → 1.4.0rc3

Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate(), a target such as yaml.unsafe_load can execute Python code through a config-controlled YAML stream containing Python object-construction tags. Impact and prerequisites The attacker must control the relevant target and arguments that the application instantiates. The configured callable executes with the application's process privileges. This…

GitHub Advisory Databaseで読む

2026/10/28 02:08、GitHub Advisory Databaseが「Hydra legacy target blacklist permits unsafe PyYAML loading」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。