https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:10:33 +0000 https://vulnerability.circl.lu/vuln/brew-dvc-cve-2026-68508 <p><strong>Affected:</strong> Homebrew: dvc</p> <p>## Summary</p> <p>`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.</p> <p>Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.</p> <p>## Details</p> <p>Hydra&#39;s instantiate API is designed to construct objects and call functions from configuration. For example:</p> <p>```yaml component: _target_: package.module.Class arg: value ```</p> <p>When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.</p> <p>This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.</p> <p>This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:</p> <p>https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/</p> <p>Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…</p> <p><strong>Affected:</strong> Homebrew: dvc</p> <p>## Summary</p> <p>`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.</p> <p>Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.</p> <p>## Details</p> <p>Hydra&#39;s instantiate API is designed to construct objects and call functions from configuration. For example:</p> <p>```yaml component: _target_: package.module.Class arg: value ```</p> <p>When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.</p> <p>This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.</p> <p>This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:</p> <p>https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/</p> <p>Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…</p> https://vulnerability.circl.lu/vuln/brew-dvc-cve-2026-68508 https://vulnerability.circl.lu/vuln/fkie_cve-2026-68508 <p>Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.</p> <p>Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-68508 https://vulnerability.circl.lu/vuln/ghsa-2cp2-2r3c-7p7r <p><strong>Affected:</strong> PyPI: hydra-core</p> <p>## Summary</p> <p>`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.</p> <p>Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.</p> <p>## Details</p> <p>Hydra&#39;s instantiate API is designed to construct objects and call functions from configuration. For example:</p> <p>```yaml component: _target_: package.module.Class arg: value ```</p> <p>When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.</p> <p>This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.</p> <p>This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:</p> <p>https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/</p> <p>Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…</p> <p><strong>Affected:</strong> PyPI: hydra-core</p> <p>## Summary</p> <p>`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.</p> <p>Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.</p> <p>## Details</p> <p>Hydra&#39;s instantiate API is designed to construct objects and call functions from configuration. For example:</p> <p>```yaml component: _target_: package.module.Class arg: value ```</p> <p>When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.</p> <p>This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.</p> <p>This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:</p> <p>https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/</p> <p>Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…</p> https://vulnerability.circl.lu/vuln/ghsa-2cp2-2r3c-7p7r https://vulnerability.circl.lu/vuln/pysec-2026-3850 <p><strong>Affected:</strong> PyPI: hydra-core</p> <p>## Summary</p> <p>`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.</p> <p>Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.</p> <p>## Details</p> <p>Hydra&#39;s instantiate API is designed to construct objects and call functions from configuration. For example:</p> <p>```yaml component: _target_: package.module.Class arg: value ```</p> <p>When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.</p> <p>This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.</p> <p>This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:</p> <p>https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/</p> <p>Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…</p> <p><strong>Affected:</strong> PyPI: hydra-core</p> <p>## Summary</p> <p>`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.</p> <p>Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.</p> <p>## Details</p> <p>Hydra&#39;s instantiate API is designed to construct objects and call functions from configuration. For example:</p> <p>```yaml component: _target_: package.module.Class arg: value ```</p> <p>When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.</p> <p>This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.</p> <p>This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:</p> <p>https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/</p> <p>Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3850 https://vulnerability.circl.lu/vuln/rhsa-2026:70965 <p>python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting vllm: vLLM: Denial of Service via unbounded video frame processing aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() vllm: vLLM: Arbitrary code execution via malicious HuggingFace model vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding Diffusers: Diffusers: Arbitrary remote code execution via `trust_remote_code` bypass diffusers: Diffusers: Arbitrary Code Execution via malicious model loading diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens starlette: Starlette: Security restriction bypass via malformed HTTP Host header vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files vllm: vLLM: Denial of Service via malformed speculative decoding workload starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API msgpac…</p> <p>python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting vllm: vLLM: Denial of Service via unbounded video frame processing aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() vllm: vLLM: Arbitrary code execution via malicious HuggingFace model vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding Diffusers: Diffusers: Arbitrary remote code execution via `trust_remote_code` bypass diffusers: Diffusers: Arbitrary Code Execution via malicious model loading diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens starlette: Starlette: Security restriction bypass via malformed HTTP Host header vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files vllm: vLLM: Denial of Service via malformed speculative decoding workload starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API msgpac…</p> https://vulnerability.circl.lu/vuln/rhsa-2026:70965