Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
hydra.utils.instantiate() resolves and calls Python objects from config. If an application passes untrusted config to instantiate(), an attacker who controls target and its arguments can cause arbitrary code execution in the consuming process. Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to hydra.utils.instantiate().