hydra-ray-launcher: Config-controlled module imports through the Ray version resolver

Summary

The hydra-ray-launcher plugin registers the ray_pkg_version OmegaConf resolver. In affected versions, a configuration interpolation can select a module for the resolver to import before reading the module's version. Plugin discovery registers this resolver even when another launcher is selected.

Impact

An attacker who controls configuration or CLI overrides can trigger an import in the application's process. Harmful impact requires an importable module with a harmful import side effect. The resolver does not install attacker code or pass arbitrary function arguments. AWS credentials and Ray job execution are not prerequisites.

Hydra 1.4's target execution whitelist does not mediate this resolver path. Hydra 1.3's target blocklist provides defense in depth; it is not a supported security boundary for arbitrary untrusted configuration.

Affected versions

Affected package: hydra-ray-launcher.

• Legacy family: >=1.1.0.dev1,<1.2.2.
• Hydra 1.4 family: >=1.4.0.dev4,<1.4.0rc2.

The earlier 0.1.x packages do not contain this resolver.

Patches

Patched versions 1.2.2 and 1.4.0rc2 are available on PyPI. Their wheel and source distributions have been verified.

The fix reads installed distribution metadata instead of importing modules. Use distribution names for custom resolver arguments: replace ${ray_pkg_version:yaml} with ${ray_pkg_version:PyYAML}. The existing hydra argument remains an alias for hydra-core. Packages must be installed, including editable installations, or their versions supplied explicitly. There is no import fallback when metadata is unavailable.

The patched legacy plugin requires Python 3.8 or newer. This makes explicit the requirement of importlib.metadata, already used in plugin 1.2.1. The Hydra 1.4 plugin retains its Python 3.10 minimum.

Workarounds

Upgrade hydra-ray-launcher to 1.2.2 or 1.4.0rc2, depending on your release line.

If you cannot upgrade immediately, uninstall the plugin if unused and restart the application, or restrict externally controlled configuration. Selecting another launcher alone does not prevent resolver registration.

Credit

Reported by @zachariah-mithani.