{"id":"CVE-2026-115749","title":"hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import","summary":"hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling conf…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-470"],"vendor":"hydra-ecosystem","product":"hydra-ray-launcher","affected":["hydra-ray-launcher >= 1.1.0.dev1 < 1.2.2","hydra-ray-launcher >= 1.4.0.dev4 < 1.4.0rc2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T14:48:51.432418Z"},"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T14:58:26.781Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115749","references":[{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-h34c-q33w-3r7q","label":"GitHub Security Advisory (GHSA-h34c-q33w-3r7q)"},{"url":"https://github.com/hydra-ecosystem/hydra/pull/3566"},{"url":"https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd54dbfc041616b1229bd1614b73d765"},{"url":"https://pypi.org/project/hydra-ray-launcher/1.2.2/"},{"url":"https://www.vulncheck.com/advisories/hydra-ray-launcher-1.1.0-dev1-before-1.2.2-and-1.4.0-dev4-before-1.4-0rc2-arbitrary-module-import","label":"VulnCheck Advisory: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.501Z","slug":"CVE-2026-115749","body":"## Overview\n\nhydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.\n\n## Affected\n\n- `hydra-ray-launcher >= 1.1.0.dev1 < 1.2.2`\n- `hydra-ray-launcher >= 1.4.0.dev4 < 1.4.0rc2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}