{"items":[{"id":"NVI-00009187","kind":"vulnerability","title":"Hydra legacy target blacklist permits unsafe PyYAML loading","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wf6j-7hvr-gr93"],"plain_summary":"GitHub lists this reviewed advisory for hydra-core, hydra-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-e7b44a9f372423af7687a03961fc2770"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T17:08:42.000Z","value":"7.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-e7b44a9f372423af7687a03961fc2770"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e7b44a9f372423af7687a03961fc2770","url":"https://github.com/advisories/GHSA-wf6j-7hvr-gr93","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wf6j-7hvr-gr93","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e7b44a9f372423af7687a03961fc2770"],"technology":"hydra-core","known_exclusions":[],"conditions_summary":"## Summary\n\nHydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an\napplication passes attacker-controlled targets and arguments to instantiate(),\na target such as yaml.unsafe_load can execute Python code through a\nconfig-controlled YAML stream containing Python object-construction tags.\n\n## Impact and prerequisites\n\nThe attacker must control the relevant target and arguments that the application\ninstantiates. The configured callable executes with the application's process\nprivileges. This is a gap in the best-effort legacy blacklist. It is not a bypass\nof Hydra 1.4's execution whitelist supplied by trusted Python code.\n\nOne realistic exposure is a model downloaded from a third-party repository,\nsuch as Hugging Face, that bundles attacker-controlled configuration. When a\nvictim loads the model using application code that passes this configuration\nto legacy Hydra instantiation without effective target restrictions, the\nmodel's metadata can execute code in the victim process. This model-loading\nattack pattern is documented in the original Hydra advisory\nGHSA-2cp2-2r3c-7p7r and the associated Unit 42 research. It does not imply that\nall Hugging Face models or cur","public_affected_ranges":[">= 1.3.6, < 1.3.8"]},{"certainty":"source_listed","source_ids":["sr-e7b44a9f372423af7687a03961fc2770"],"technology":"hydra-core","known_exclusions":[],"conditions_summary":"## Summary\n\nHydra's legacy target blacklist omits PyYAML's unsafe loading surfaces. If an\napplication passes attacker-controlled targets and arguments to instantiate(),\na target such as yaml.unsafe_load can execute Python code through a\nconfig-controlled YAML stream containing Python object-construction tags.\n\n## Impact and prerequisites\n\nThe attacker must control the relevant target and arguments that the application\ninstantiates. The configured callable executes with the application's process\nprivileges. This is a gap in the best-effort legacy blacklist. It is not a bypass\nof Hydra 1.4's execution whitelist supplied by trusted Python code.\n\nOne realistic exposure is a model downloaded from a third-party repository,\nsuch as Hugging Face, that bundles attacker-controlled configuration. When a\nvictim loads the model using application code that passes this configuration\nto legacy Hydra instantiation without effective target restrictions, the\nmodel's metadata can execute code in the victim process. This model-loading\nattack pattern is documented in the original Hydra advisory\nGHSA-2cp2-2r3c-7p7r and the associated Unit 42 research. It does not imply that\nall Hugging Face models or cur","public_affected_ranges":[">= 1.4.0.dev9, < 1.4.0rc3"]}],"null_published_at":"2026-10-31T22:13:31.289Z","source_updated_at":"2026-10-27T17:08:42.000Z","source_disclosed_at":"2026-10-27T17:08:41.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:36.327Z"}],"next_cursor":null,"snapshot_revision":"42594"}