---
id: CVE-2026-115749
title: >-
  hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2
  Arbitrary Module Import
summary: >-
  hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2
  contains an arbitrary module import vulnerability via the ray_pkg_version
  OmegaConf resolver passing input to importlib.import_module(). Attackers
  controlling conf…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-470
vendor: hydra-ecosystem
product: hydra-ray-launcher
affected:
  - hydra-ray-launcher >= 1.1.0.dev1 < 1.2.2
  - hydra-ray-launcher >= 1.4.0.dev4 < 1.4.0rc2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T14:48:51.432418Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T14:58:26.781Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115749'
references:
  - url: >-
      https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-h34c-q33w-3r7q
    label: GitHub Security Advisory (GHSA-h34c-q33w-3r7q)
  - url: 'https://github.com/hydra-ecosystem/hydra/pull/3566'
  - url: >-
      https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd54dbfc041616b1229bd1614b73d765
  - url: 'https://pypi.org/project/hydra-ray-launcher/1.2.2/'
  - url: >-
      https://www.vulncheck.com/advisories/hydra-ray-launcher-1.1.0-dev1-before-1.2.2-and-1.4.0-dev4-before-1.4-0rc2-arbitrary-module-import
    label: >-
      VulnCheck Advisory: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and
      1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.501Z'
---

## Overview

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

## Affected

- `hydra-ray-launcher >= 1.1.0.dev1 < 1.2.2`
- `hydra-ray-launcher >= 1.4.0.dev4 < 1.4.0rc2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.