Hydra Python Package: Arbitrary Code Execution Risk
- Severity
- HIGH
- Affected component
- hydra (pypi)
- Patched version
- 1.3.4
The Hydra Python package's hydra.utils.instantiate() function can reportedly lead to arbitrary code execution if untrusted configuration is passed to it. This issue is under investigation.
What happened
An early warning has been issued regarding the Hydra Python package. The hydra.utils.instantiate() function can lead to arbitrary code execution if untrusted configuration is passed to it. This can allow an attacker to execute code in the process that calls hydra.utils.instantiate(). The issue is being investigated and no exploitation in the wild has been confirmed.
The affected versions of the Hydra package are those below version 1.3.4. Users of these versions are advised to assess their exposure and take appropriate action. The issue has been tracked under the ID GHSA-2CP2-2R3C-7P7R.
What to do about it
- Upgrade to Hydra version 1.3.4 or later to mitigate the risk of arbitrary code execution.
- Review your project dependencies to identify if Hydra is being used and if so, which version.
- If your project uses Hydra, ensure that all configurations passed to hydra.utils.instantiate() are trusted.
- Monitor the primary sources for updates on the issue and any additional mitigation advice.
How 0Day would have caught this
hydra is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if your project uses Hydra Python package versions below 1.3.4.
What should I do right now?
Upgrade to Hydra version 1.3.4 or later and ensure that all configurations passed to hydra.utils.instantiate() are trusted.
Has this been exploited in the wild?
There is no confirmed exploitation in the wild at this time.
Where can I get more information?
Consult the primary sources for the most up-to-date information on this issue.