CVE-2026-115749: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the raypkgversion OmegaConf resolver passing input to importlib.importmodule(). Attackers controlling configuration values or command-line overrides can supply a raypkgversion interpolation to import any installed module, triggering its import-time side effects in the application process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hydra-ray-launcherto a version that resolves this vulnerability.Fixed in 1.2.2 - Upgrade
Upgrade
hydra-ray-launcherto a version that resolves this vulnerability.Fixed in 1.4.0rc2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments using affected hydra-ray-launcher versions are exposed only when an attacker can control configuration values or command-line overrides processed by the application.
What does an attacker need to supply?
The attacker must provide a ray_pkg_version OmegaConf interpolation. Its value is passed to importlib.import_module(), allowing import of an installed module and execution of that module's import-time side effects.
Which versions should be remediated?
Upgrade versions in the 1.1.0.dev1 through pre-1.2.2 range to 1.2.2 or later. Upgrade versions in the 1.4.0.dev4 through pre-1.4.0rc2 range to 1.4.0rc2 or later.