PYPI · AUGUST 2026 · EARLY WARNING

Hydra Python Package: Arbitrary Code Execution Risk

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
hydra (pypi)
Patched version
1.3.4
GHSA-2CP2-2R3C-7P7R

The Hydra Python package's hydra.utils.instantiate() function can reportedly lead to arbitrary code execution if untrusted configuration is passed to it. This issue is under investigation.

What happened

An early warning has been issued regarding the Hydra Python package. The hydra.utils.instantiate() function can lead to arbitrary code execution if untrusted configuration is passed to it. This can allow an attacker to execute code in the process that calls hydra.utils.instantiate(). The issue is being investigated and no exploitation in the wild has been confirmed.

The affected versions of the Hydra package are those below version 1.3.4. Users of these versions are advised to assess their exposure and take appropriate action. The issue has been tracked under the ID GHSA-2CP2-2R3C-7P7R.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If hydra is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are potentially affected if your project uses Hydra Python package versions below 1.3.4.

What should I do right now?

Upgrade to Hydra version 1.3.4 or later and ensure that all configurations passed to hydra.utils.instantiate() are trusted.

Has this been exploited in the wild?

There is no confirmed exploitation in the wild at this time.

Where can I get more information?

Consult the primary sources for the most up-to-date information on this issue.

Sources

Join the 0Day waitlist →

← Back to all threats