Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

hydra-core

5 known vulnerabilities (5 high), with the versions each affects and the releases that fix them.

Latest release
1.3.8 (Oct 25, 2026): no advisory affects it
Newest unaffected release
1.3.8 (Oct 25, 2026), the latest release
Advisories
5 · 5 high
Weekly downloads
4.2M
Dependents
0
Releases
64 since 0.1.4 (Sep 19, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • GHSA-WF6J-7HVR-GR93
    Affects 1.3.6 to 1.3.7 (1.3.8 is outside it); 1.4.0.dev9 to 1.4.0rc2 (1.4.0rc3 is outside it)
  • CVE-2026-106442
    Affects 1.3.4 to 1.3.5 (1.3.6 is outside it); 1.4.0.dev1 to 1.4.0.dev8 (1.4.0.dev9 is outside it)
  • CVE-2026-106441
    Affects 0.1.4 to 1.3.5 (1.3.6 is outside it); 1.4.0.dev1 to 1.4.0.dev8 (1.4.0.dev9 is outside it)
  • CVE-2026-106439
    Affects 1.3.4 to 1.3.6 (1.3.7 is outside it); 1.4.0.dev4 to 1.4.0.dev9 (1.4.0.dev10 is outside it)
  • CVE-2026-68508
    Affects 0.1.4 to 1.3.3 (1.3.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Hydra legacy target blacklist permits unsafe PyYAML loading

    Affected: from 1.3.6, fixed in 1.3.8; from 1.4.0.dev9, fixed in 1.4.0rc3.

    Fixed in 1.3.8 (released Oct 25, 2026, 2 days before disclosure) and 1.4.0rc3 (released Oct 25, 2026, 2 days before disclosure).

    The latest release, 1.3.8, is not affected.

  • Hydra instantiate target blacklist bypasses permit code execution

    Affected: from 1.3.4, fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9; from 1.3.4, fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9.

    Fixed in 1.3.6 (released Aug 29, 2026, 38 days before disclosure) and 1.4.0.dev9 (released Aug 30, 2026, 37 days before disclosure).

    The latest release, 1.3.8, is not affected.

  • Hydra logging configuration permits unsafe callable resolution

    Affected: fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9; fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9.

    Fixed in 1.3.6 (released Aug 29, 2026, 38 days before disclosure) and 1.4.0.dev9 (released Aug 30, 2026, 37 days before disclosure).

    The latest release, 1.3.8, is not affected.

  • Hydra: Mutable instantiate policy sets allow target blocklist bypass

    Affected: from 1.3.4, fixed in 1.3.7; from 1.4.0.dev4, fixed in 1.4.0.dev10; from 1.3.4, fixed in 1.3.7; from 1.4.0.dev4, fixed in 1.4.0.dev10.

    Fixed in 1.3.7 (released Sep 14, 2026, 22 days before disclosure) and 1.4.0.dev10 (released Sep 14, 2026, 22 days before disclosure).

    The latest release, 1.3.8, is not affected.

  • Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

    Affected: fixed in 1.3.4.

    Fixed in 1.3.4 (released Jul 4, 2026, 48 days before disclosure).

    The latest release, 1.3.8, is not affected.