hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the raypkgversion OmegaConf resolver passing input to importlib.importmodule(). Attackers controlling configuration values or command-line overrides can supply a raypkgversion interpolation to import any installed module, triggering its import-time side effects in the application process.