HighVulnerabilityGHSA-wf6j-7hvr-gr93updated 27 Oct 2026, 17:09 UTC

Hydra config tool can run Python code from untrusted YAML

Hydra is a Python library that builds objects from config files. If an app feeds it config files from an untrusted source, an attacker can hide Python commands in the YAML and have them run on the app's machine.

Fix availableOfficial source

Severity	HighCVSS 7.8 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yeshydra-core 1.3.8 (1.3 line); hydra-core 1.4.0rc3 (1.4 line) · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Attacker crafts configHides YAML Python-object tags in config
2Config shared or downloadede.g. a third-party model bundle
3App passes config to HydraCalls instantiate() with untrusted targets
4yaml.unsafe_load runsBlacklist misses PyYAML unsafe surfaces
5Code runs in app processRuns with app's privileges
ResultAttacker runs code on the victim's system

What happened

Hydra's legacy target blacklist does not block PyYAML's unsafe loading functions, such as yaml.unsafe_load. Attacker-controlled config passed to instantiate() or call() can execute Python code via YAML object-construction tags.

Why it is dangerous: Code runs with the application's process privileges, so an attacker can take over the process or the host. Applications that load third-party models or configs containing this metadata are at risk.

Are you affected?

You are affected if you use hydra-core 1.3.6 through 1.3.7 or a 1.4 prerelease (1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2) and pass untrusted configuration to instantiate() or call().

Package / product	Affected versions	Fixed in
hydra-core · pip	>= 1.3.6, < 1.3.8	1.3.8
hydra-core · pip	>= 1.4.0.dev9, < 1.4.0rc3	1.4.0rc3

What to do

Update hydra-core to 1.3.8 or later, or 1.4.0rc3 or later
Do not pass untrusted configuration to instantiate() or call() until updated
For Hydra 1.4, supply a narrow execution whitelist from trusted Python code

Timeline

27 Oct 2026, 17:08 UTC
Publicly disclosed
27 Oct 2026, 17:08 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 17:09 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Hydra legacy target blacklist permits unsafe PyYAML loadingGitHub Advisory · 27 Oct 2026, 17:08 UTC

Technical details

ID: GHSA-wf6j-7hvr-gr93
CVSS: 7.8 / 10
Disclosed: 27 Oct 2026, 17:08 UTC
On Zero Radar: 27 Oct 2026, 17:09 UTC (1 min after disclosure)
Last change: 27 Oct 2026, 17:09 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works