CVE-2026-115749

Published: Ott 23, 2026 Last Modified: Ott 23, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW 3,3
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none

Description

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Dos: Crash, Exit, Or Restart Other Read Application Data
Applicable Platforms
Languages: Java, PHP, Interpreted
View CWE Details
https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd5…
https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd54dbfc041616b1229bd16…
https://github.com/hydra-ecosystem/hydra/pull/3566
https://github.com/hydra-ecosystem/hydra/pull/3566
https://github.com/hydra-ecosystem/hydra/security/advisorie…
https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-h34c-q33w-3r7q
https://pypi.org/project/hydra-ray-launcher/1.2.2/
https://pypi.org/project/hydra-ray-launcher/1.2.2/
https://www.vulncheck.com/advisories/hydra-ray-launcher-1.1…
https://www.vulncheck.com/advisories/hydra-ray-launcher-1.1.0-dev1-before-1.2.2…