CVE-2026-115749

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray pkg version OmegaConf resolver passing input to importlib.import module(). Attackers controlling configuration values or command-line overrides can supply a ray pkg version interpolation to import any installed module, triggering its import-time side effects in the application process.