CVE-2026-68508

## Summary `hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untrusted config to `instantiate()`, an attacker who controls `_target_` and its arguments can cause arbitrary code execution in the consuming process. Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to `hydra.utils.instantiate()`. ## Details Hydra's instantiate API is designed to construct objects and call functions from configuration. For example: ```yaml component: _target_: package.module.Class arg: value ``` When this config is passed to `hydra.utils.instantiate()`, Hydra resolves `_target_` and calls it with the provided arguments. This is intended for trusted application configuration. However, if untrusted input controls `_target_`, the config becomes a callable-selection mechanism. A malicious config can select a callable capable of executing code or commands and provide attacker-controlled arguments. This issue is the same general class of problem discussed by Unit 42 for downstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata was passed into Hydra instantiate: https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/ Hydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That blacklist is defense-in-depth and is not a complete security boundary. The blacklist is not present in the released `hydra-core` 1.3.3 package, so this issue should not be described as a bypass of a released 1.3.3 blacklist. ## Impact A successful attack can execute code in the process that calls `hydra.utils.instantiate()`. The impact is limited to the privileges and environment of that process. Potential impact includes: - Reading files, credentials, environment variables, or data accessible to the process - Modifying files, outputs, checkpoints, or applicat