Product
The hydra.utils.instantiate() function in hydra-core versions 1.3.3 and below is vulnerable to arbitrary code execution when processing untrusted configuration input, allowing attackers to hijack object instantiation.