hydra-core PyYAML blocklist bypass allows arbitrary code execution

Vulnerability GHSA-wf6j-7hvr-gr93 (CVSS 7.8) in hydra-core 1.3.6–1.3.7 and 1.4.0.dev9–1.4.0rc2 lets attackers execute arbitrary code because the blocklist omitted the yaml. namespace, allowing yaml.unsafe_load via hydra.utils.instantiate(). Fixed in 1.3.8 and 1.4.0rc3; a proof-of-concept exists.

• CVSS 7.8: blocklist bypass via yaml.unsafe_load in hydra.utils.instantiate()
• Affected: hydra-core 1.3.6–1.3.7 and 1.4.0.dev9–1.4.0rc2
• Patched in 1.3.8 and 1.4.0rc3, which block yaml.* except safe_load and safe_dump
• Proof-of-concept available; exploit needs untrusted configuration input