Hydra Ecosystem Hydra code injection vulnerability

In Hydra Ecosystem, versions prior to Hydra 1.2.2—specifically 1.1.0.dev1 and 1.4.0.dev4—contain a code injection vulnerability. This vulnerability arises because the raypkgversion OmegaConf parser passes input to importlib.importmodule, potentially allowing arbitrary module imports. Attackers ca...

PYSEC-2026-33

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...