Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summaryhydra-optuna-sweeper accepted a configuration-controlled dotted path inhydra.sweeper.customsearchspace, resolved it with the lower-levelhydra.utils.getmethod API, and later invoked the returned callable.Hydra's object-lookup helpers intentionally trust their input and do not applythe...

PYSEC-2026-4224 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

GHSA-5JJJ-9XC3-RM56 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

EUVD-2026-93661

Hydra: Optuna customsearchspace can resolve and execute untrusted callables via getmethod...

CVE-2026-106440

A flaw was found in hydra-optuna-sweeper. This vulnerability allows an attacker who controls sweep configuration settings or command-line overrides to achieve arbitrary code execution. The component dynamically resolves and invokes callable objects specified in user-controlled configuration paths...

CVE-2026-106440

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolves it with hydra.utils.getmethod, and later invokes the returned...

CVE-2026-106440 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolves it with hydra.utils.getmethod, and later invokes the returned...

CVE-2026-106440

The hydra-optuna-sweeper package (versions 1.2.0 to 1.3.0 and 1.4.0.dev10 ) is vulnerable to arbitrary code execution. An attacker who controls Optuna sweep configurations or command-line overrides can provide a configuration-controlled dotted path in hydra.sweeper.custom_search_space. The system...

CVE-2026-106440

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolves it with hydra.utils.getmethod, and later invokes the returned...

CVE-2026-106440 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolves it with hydra.utils.getmethod, and later invokes the returned...

alphafold3-pytorch-lightning-hydra (>=0.2.126, <=0.4.28), cosyvoice-package (0.0.2) +7 more potentially affected by CVE-2026-106440 via hydra-optuna-sweeper (1.2.0)

hydra-optuna-sweeper PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-optuna-sweeper and may be impacted: - alphafold3-pytorch-lightning-hydra =0.2.126, =0.0.1, =0.0.1.dev4, =0.4.0, =2.2.0, =2.9.0 - reverse-distillation 0.1.0...

CVE-2026-106440 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolves it with hydra.utils.getmethod, and later invokes the returned...

PT-2026-107101

Name of the Vulnerable Software and Affected Versions hydra-optuna-sweeper versions 1.2.0 through 1.3.0 hydra-optuna-sweeper versions 1.4.0.dev1 through 1.4.0.dev9 Description The hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom search space, whi...

CVE-2026-106440: Use of Externally-Controlled Input to Select Classes or Code

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolves it with hydra.utils.getmethod, and later invokes the returned...