CVE-2026-106440

The hydra-optuna-sweeper package (versions 1.2.0 to 1.3.0 and 1.4.0.dev10 ) is vulnerable to arbitrary code execution. An attacker who controls Optuna sweep configurations or command-line overrides can provide a configuration-controlled dotted path in hydra.sweeper.custom_search_space. The system...