{"id":"GHSA-5jjj-9xc3-rm56","summary":"Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method","details":"## Summary\n\n`hydra-optuna-sweeper` accepted a configuration-controlled dotted path in\n`hydra.sweeper.custom_search_space`, resolved it with the lower-level\n`hydra.utils.get_method()` API, and later invoked the returned callable.\n\nHydra's object-lookup helpers intentionally trust their input and do not apply\nthe execution policy used by `instantiate()` and logging configuration. As a\nresult, untrusted Optuna multirun configuration could select installed Python\ncode for execution in the Hydra controller process.\n\n## Impact\n\nExploitation requires control of an application's Optuna sweep configuration\nor command-line overrides and an importable callable in the application's\nenvironment. Selected code runs with the privileges of the application.\n\nOn affected Hydra 1.4 development releases, this path bypasses an execution\nwhitelist provided by trusted application code. Hydra 1.3 has no execution-whitelist\nsecurity boundary; there, the same change restores the legacy blocklist as\ndefense in depth.\n\n## Fix\n\nThe Optuna sweeper now resolves the configured callback through\n`hydra.utils.instantiate()` as a partial callable. On Hydra 1.4, the active\nexecution whitelist therefore authorizes the callback before use. On Hydra\n1.3, the legacy blocklist is applied as defense in depth.\n\nThe public `get_object()`, `get_method()`, `get_static_method()`, and\n`get_class()` helpers remain lower-level trusted-input APIs. Their documentation\nnow warns against passing values derived from untrusted configuration and\ndirects config-driven construction to `instantiate()`.\n\n## Affected versions\n\n- Package: `hydra-optuna-sweeper`\n- Stable affected range: `\u003e= 1.2.0, \u003c 1.3.0`\n- Stable fixed version: `1.3.0`\n- Development affected range: `\u003e= 1.4.0.dev4, \u003c 1.4.0.dev10`\n- Development fixed version: `1.4.0.dev10`\n\nThe feature was introduced in `1.2.0` and is absent from the 1.1 release line.\nThe 1.4 development line was affected from 1.4.0.dev4 through 1.4.0.dev9.\n\n## Workaround\n\nTreat Optuna sweep configuration and command-line overrides as trusted. Do not\nset `custom_search_space` from externally controlled input or allow untrusted\nusers to place modules on the application import path.\n\nReported by zx (GitHub: @manus-pi).","aliases":["CVE-2026-106440"],"modified":"2026-10-07T20:30:04.848763480Z","published":"2026-10-07T20:24:02Z","database_specific":{"cwe_ids":["CWE-470"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-07T20:24:02Z","nvd_published_at":"2026-10-06T19:18:12Z"},"references":[{"type":"WEB","url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106440"},{"type":"WEB","url":"https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6"},{"type":"WEB","url":"https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168"},{"type":"PACKAGE","url":"https://github.com/hydra-ecosystem/hydra"},{"type":"WEB","url":"https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7"}],"affected":[{"package":{"name":"hydra-optuna-sweeper","ecosystem":"PyPI","purl":"pkg:pypi/hydra-optuna-sweeper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.3.0"}]}],"versions":["1.2.0","1.3.0.dev0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5jjj-9xc3-rm56/GHSA-5jjj-9xc3-rm56.json"}},{"package":{"name":"hydra-optuna-sweeper","ecosystem":"PyPI","purl":"pkg:pypi/hydra-optuna-sweeper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0.dev4"},{"fixed":"1.4.0.dev10"}]}],"versions":["1.4.0.dev4","1.4.0.dev5","1.4.0.dev6","1.4.0.dev7","1.4.0.dev8","1.4.0.dev9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5jjj-9xc3-rm56/GHSA-5jjj-9xc3-rm56.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}