hydra-optuna-sweeper
Hydra is a framework for elegantly configuring complex applications
View on Github
Activity
- Latest release
- 4d ago
- Total releases
- 20
- Cadence
- ~25 days
- Last 12 months
- 11
Reach
- Stars
- 10.7k
Details
- License
- MIT
- First release
- Nov 27, 2020
| Version | Released | |
|---|---|---|
1.4.0rc3
pre
| ||
1.4.0rc2
pre
| ||
1.4.0rc1
pre
| ||
1.3.0
minor
| ||
1.4.0.dev10
pre
| ||
1.4.0.dev9
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.4.0.dev8
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.4.0.dev7
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.4.0.dev6
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.4.0.dev5
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.4.0.dev4
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.3.0.dev0
pre
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-106440
PYSEC-2026-4224
GHSA-5jjj-9xc3-rm56
Oct 15, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
7.8
/ 10
High
Local
Low
None
Required
Unchanged
High
High
High
Summary
Hydra's object-lookup helpers intentionally trust their input and do not apply
the execution policy used by ImpactExploitation requires control of an application's Optuna sweep configuration or command-line overrides and an importable callable in the application's environment. Selected code runs with the privileges of the application. On affected Hydra 1.4 development releases, this path bypasses an execution whitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist security boundary; there, the same change restores the legacy blocklist as defense in depth. FixThe Optuna sweeper now resolves the configured callback through
The public Affected versions
The feature was introduced in WorkaroundTreat Optuna sweep configuration and command-line overrides as trusted. Do not
set Reported by zx (GitHub: @manus-pi). Affected versions
1.2.0
1.3.0.dev0
1.4.0.dev4
1.4.0.dev5
1.4.0.dev6
1.4.0.dev7
1.4.0.dev8
1.4.0.dev9
Fixed in
1.3.0
1.4.0.dev10
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.1.2
patch
| ||
1.1.1
patch
| ||
1.1.0
initial
| ||
1.1.0.dev2
pre
| ||
1.1.0.dev1
pre
| ||
0.9.0rc2
pre
| ||
0.9.0rc1
pre
|