hydra-core 因 PyYAML 目標封鎖清單缺漏而存在任意程式碼執行漏洞

GHSA-wf6j-7hvr-gr93: Arbitrary Code Execution via PyYAML Target Blocklist Bypass in hydra-core

Vulnerability ID: GHSA-WF6J-7HVR-GR93
CVSS Score: 7.8
Published: 2026-10-27

A high-severity target blocklist omission in the hydra-core Python package (versions 1.3.6 through 1.3.7 and 1.4.0.dev9 through 1.4.0rc2) allows arbitrary code execution when instantiating untrusted configuration dictionaries. Because the execution policy failed to restrict the PyYAML (yaml.) namespace, an attacker can specify functions such as yaml.unsafe_load as the instantiation target and supply a crafted YAML stream containing Python object construction tags to execute arbitrary system commands within the host process.

TL;DR

Hydra's dynamic object instantiation blocklist omitted the PyYAML namespace (yaml.), enabling attackers who control configuration metadata passed to hydra.utils.instantiate() or hydra.utils.call() to invoke yaml.unsafe_load and achieve arbitrary code execution.

⚠️ Exploit Status: POC

Technical Details

Advisory ID: GHSA-wf6j-7hvr-gr93 (GHSA-757g-8w3h-hp29)
Primary CWE: CWE-184 (Incomplete List of Disallowed Inputs)
Secondary CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3.1 Score: 7.8 High (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Attack Vector: Local / Untrusted Configuration Instantiation
Impact: Arbitrary Code Execution
Exploit Status: Proof-of-Concept Available
Patched Versions: hydra-core 1.3.8, 1.4.0rc3

Affected Systems

hydra-core (PyPI)
hydra-core: >= 1.3.6, < 1.3.8 (Fixed in: 1.3.8)
hydra-core: >= 1.4.0.dev9, < 1.4.0rc3 (Fixed in: 1.4.0rc3)

Code Analysis

Commit: 9a7a9a2

Block yaml.* in execution_policy.py and target_policy.py on main (1.4) branch, allowing only safe_load/safe_dump variants.

--- a/hydra/_internal/execution_policy.py
+++ b/hydra/_internal/execution_policy.py
@@ -356,6 +356,9 @@
     # unpickles a counts file. The inert Trace constructor is excepted below.
     "shelve.",
     "trace.",
+    # PyYAML exposes Python-object loading and constructor dispatch. Keep only
+    # exact safe load/dump functions available.
+    "yaml.",
     # pydoc imports/executes modules and files (importfile runs a file,
     # safeimport imports by name). Inert documentation formatters are excepted
     # below.
@@ -367,7 +370,7 @@
     "bdb.",
 )

-# Exact legitimate constructors within otherwise denied module families. Exact
+# Exact legitimate targets within otherwise denied module families. Exact
 # entries in UNCONTROLLED_EXECUTION_TARGETS still take precedence over exceptions.
 # An exception permits only the named target, not its methods or descendants.
 UNCONTROLLED_EXECUTION_TARGET_PREFIX_EXCEPTIONS = frozenset(
@@ -378,6 +381,10 @@
         "pydoc.HTMLDoc",
         "pydoc.TextDoc",
         "trace.Trace",
+        "yaml.safe_load",
+        "yaml.safe_load_all",
+        "yaml.safe_dump",
+        "yaml.safe_dump_all",
     }
 )

Commit: de55543

Backport yaml.* target blocklist updates and digest verification to the 1.3 branch.

--- a/hydra/_internal/target_policy.py
+++ b/hydra/_internal/target_policy.py
@@ -320,6 +320,9 @@
     "doctest.",
     "shelve.",
     "trace.",
+    # PyYAML exposes Python-object loading and constructor dispatch. Keep only
+    # exact safe load/dump functions available.
+    "yaml.",
     "pydoc.",
     "pdb.",
     "bdb.",
@@ -333,6 +336,10 @@
         "pydoc.HTMLDoc",
         "pydoc.TextDoc",
         "trace.Trace",
+        "yaml.safe_load",
+        "yaml.safe_load_all",
+        "yaml.safe_dump",
+        "yaml.safe_dump_all",
     }
 )

Exploit Details

GitHub Security Advisory: Official advisory and regression test cases demonstrating arbitrary code execution via target: yaml.unsafe_load.

Mitigation Strategies

Upgrade hydra-core to a patched version (1.3.8 or 1.4.0rc3) that blocks the yaml.* namespace by default.
Enforce strict target allowlisting using the execution_whitelist parameter in Hydra 1.4 when instantiating external configurations.
Avoid passing unvalidated, untrusted configuration dictionaries or YAML files from third-party model hubs directly to hydra.utils.instantiate() or hydra.utils.call().
Audit application code to ensure UNSAFE_DISABLE_EXECUTION_CHECKS is not set in environments handling external inputs.

Remediation Steps:

Identify all projects and container images using hydra-core versions >= 1.3.6, < 1.3.8 or >= 1.4.0.dev9, < 1.4.0rc3 (note that versions prior to 1.3.6 and 1.4.0.dev9 are also vulnerable to earlier blocklist omissions and must be upgraded).
Run pip install --upgrade 'hydra-core>=1.3.8' for stable environments or pip install --upgrade 'hydra-core>=1.4.0rc3' for prerelease environments.
Verify the installed policy integrity by confirming that hydra.utils.instantiate({'_target_': 'yaml.unsafe_load', 'stream': '1'}) raises an InstantiationException.
Refactor calls to hydra.utils.instantiate() that process user-supplied or downloaded configurations to include a hardcoded _execution_whitelist_ tuple.

References

Read the full report for GHSA-WF6J-7HVR-GR93 on our website for more details including interactive diagrams and full exploit analysis.