Vulnerability · Published Oct 23, 2026 · Assigned by VulnCheck

CVE-2026-115749hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import

Low 3.3

In plain English

A low-severity security flaw in hydra-ray-launcher from hydra-ecosystem. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 87.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

Affected products (as reported)

Vendor	Product	Versions
hydra-ecosystem	hydra-ray-launcher	1.1.0.dev1 – before 1.2.21.4.0.dev4 – before 1.4.0rc2

Weakness: CWE-470 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-h34c-q33w-3r7q) vendor-advisory
https://github.com/hydra-ecosystem/hydra/pull/3566 issue-tracking, patch
https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd54dbfc041616b1229bd1614b73d765 patch
https://pypi.org/project/hydra-ray-launcher/1.2.2/ release-notes
VulnCheck Advisory: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import third-party-advisory