CVE-2026-115749
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
The record
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119578 MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg… CWE-470
- CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
- CVE-2026-108099 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
- CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that… CWE-470
- CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
- CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their connected… CWE-470
- CVE-2026-115886 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
- CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470