Hydra legacy target blacklist permits unsafe PyYAML loading

影響: pip:hydra-core >= 1.3.6, < 1.3.8 → 1.3.8, pip:hydra-core >= 1.4.0.dev9, < 1.4.0rc3 → 1.4.0rc3

Hydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an application passes attacker-controlled targets and arguments to instantiate(), a target such as yaml.unsafe_load can execute Python code through a config-controlled YAML stream containing Python object-construction tags. Impact and prerequisites The attacker must control the relevant target and arguments that the application instantiates. The configured callable executes with the application's process privileges. This…

在 GitHub Advisory Database 阅读

2026/10/28 02:08，GitHub Advisory Database 发布了“Hydra legacy target blacklist permits unsafe PyYAML loading”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。