All vulnerabilities
CVE-2026-115749GHSA-h34c-q33w-3r7q

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import

hydra-ecosystem hydra-ray-launcher
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed in1.2.2Also 1.4.0rc2CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

Text from CVE List

Affected versions 2

  • hydra-ray-launcheraffected: 1.1.0.dev1 before 1.2.2CVE List
  • hydra-ray-launcheraffected: 1.4.0.dev4 before 1.4.0rc2CVE List

References 5