CVE-2026-68508

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 1.3.4

Description The hydra.utils.instantiate() function resolves and calls Python objects selected by configuration through the resolve target() function in hydra/ internal/instantiate/ instantiate2.py. This allows attacker-controlled target values and arguments to select dangerous callables. Applications, libraries, CLI workflows, or model loaders that pass untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() may allow the execution of arbitrary code within the process, which could lead to the reading or modification of files and credentials, or the termination of the process.

Recommendations Update to version 1.3.4.