GHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loading

Summary

Hydra's legacy target blacklist omits PyYAML's unsafe loading functions, so an application that passes attacker-controlled targets and arguments to instantiate() can let yaml.unsafe_load run Python code from a config-controlled YAML stream. The attacker must control the target and arguments, and the callable runs with the application's process privileges; the affected ranges are hydra-core 1.3.6 through 1.3.7 and the 1.4 prerelease legacy path (1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2).

Mitigation

The fix blocks the yaml. target namespace except for yaml.safe_load, yaml.safe_load_all, yaml.safe_dump, and yaml.safe_dump_all. Workarounds: do not pass untrusted configuration to instantiate() or call(), and for Hydra 1.4 supply a narrow execution whitelist from trusted Python code.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• hydra-corePyPINo LLM dependency detected · 9 tracked dependents

Related items

• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
• HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database
• HighCVE-2026-79784: Vocos class instantiation from configuration via from_pretrainedSame vendor · NVD/CVE Database