PyPI/hydra-core CVE-2026-68508: high 7.8, EPSS 0.46%

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Action: Upgrade hydra-core to 1.3.4 or later.

pip install hydra-core==1.3.4

Affected

Fixed versions

Sources

• osv: GHSA-2cp2-2r3c-7p7r
• https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r
• https://github.com/hydra-ecosystem/hydra/issues/3259
• https://github.com/hydra-ecosystem/hydra/pull/3261
• https://github.com/hydra-ecosystem/hydra/commit/7faad0dcedfb4c0a364aa1067c0080fd6fdf8dca
• https://github.com/hydra-ecosystem/hydra
• https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.4

CVE-2026-68508 · published 2026-08-21T20:57:31Z · modified 2026-09-10T12:25:59.118521669Z · JSON