Most recent entries from all

BREW-dvc-CVE-2026-68508 — Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Affected: Homebrew: dvc

## Summary

`hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process.

Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`.

## Details

Hydra's instantiate API is designed to construct objects and call functions from configuration. For example:

```yaml component: _target_: package.module.Class arg: value ```

When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments.

This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments.

This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate:

https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/

Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary.…

CVE-2026-68508 — Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Affected: facebookresearch hydra

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.

GHSA-2cp2-2r3c-7p7r — Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Affected: PyPI: hydra-core