PYSEC-2026-4223 Hydra instantiate target blacklist bypasses permit code execution

Summary Hydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete. Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

Hydra instantiate target blacklist bypasses permit code execution

Summary Hydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete. Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

CVE-2026-106442

The Hydra configuration framework is vulnerable to code execution in versions 1.3.4 through 1.3.6 and 1.4.0.dev9 . The instantiate() target blacklist, originally intended to mitigate CVE-2026-68508, fails to sufficiently validate the effective callable selected by the target field. Attackers can ...

CVE-2026-106442 Hydra instantiate target blacklist bypasses permit code execution

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable...

PT-2026-107114

Name of the Vulnerable Software and Affected Versions Hydra versions 1.3.4 through 1.3.5 Hydra versions 1.4.0.dev1 through 1.4.0.dev8 Description The instantiate function contains a flaw where the target blacklist incompletely checks the effective callable selected by the target field. Execution...