CVE-2026-106440
2 advisories.
PyPI/hydra-optuna-sweeper CVE-2026-106440: high 7.8, EPSS 0.27%
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
Action: Upgrade hydra-optuna-sweeper to 1.3.0 or later.
pip install hydra-optuna-sweeper==1.3.0pip install hydra-optuna-sweeper==1.4.0.dev10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0 | 1.3.0 | - |
| 1.4.0.dev4 | - | - |
Fixed versions
| 1.3.0 | 1.4.0.dev10 |
Sources
- osv: GHSA-5jjj-9xc3-rm56
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56
- https://nvd.nist.gov/vuln/detail/CVE-2026-106440
- https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6
- https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168
- https://github.com/hydra-ecosystem/hydra
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
CVE-2026-106440 · published · modified · JSON
PyPI/hydra-optuna-sweeper CVE-2026-106440: high 7.8, EPSS 0.27%
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
Action: Upgrade hydra-optuna-sweeper to 1.3.0 or later.
pip install hydra-optuna-sweeper==1.3.0pip install hydra-optuna-sweeper==1.4.0.dev10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0 | 1.3.0 | - |
| 1.4.0.dev4 | - | - |
Fixed versions
| 1.3.0 | 1.4.0.dev10 |
Sources
- osv: PYSEC-2026-4224
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56
- https://nvd.nist.gov/vuln/detail/CVE-2026-106440
- https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6
- https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168
- https://github.com/hydra-ecosystem/hydra
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
- https://pypi.org/project/hydra-optuna-sweeper
- https://github.com/advisories/GHSA-5jjj-9xc3-rm56
CVE-2026-106440 · published · modified · JSON