Raise puzzletron Hydra minimum to hydra-core~=1.3.4 (CVE-2026-68508) - #2341
Merged
Conversation
Hydra < 1.3.4 resolves and calls arbitrary Python objects named by a config's _target_ in hydra.utils.instantiate(). 1.3.4 adds target blocking for dangerous callables, with a HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. ModelOpt calls instantiate() only in modelopt/torch/puzzletron, on configs composed from a local directory the caller supplies, so no ModelOpt workflow was exploitable. The bump removes the vulnerable code from the dependency tree. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Keval Morabia <28916987+kevalmorabia97@users.noreply.github.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. 📝 WalkthroughWalkthroughThe ChangesDependency declaration
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to Puzzletron installations will resolve Hydra 1.3.4 or later within the 1.3 series, replacing the prior vulnerable pin without changing the public API. No merge-blocking risk remains. Suggested reviewers: 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2341 +/- ##
==========================================
- Coverage 79.31% 78.81% -0.51%
==========================================
Files 527 527
Lines 61487 61487
==========================================
- Hits 48770 48458 -312
- Misses 12717 13029 +312
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
kevalmorabia97
added
the
cherry-pick-done
Contributor
|
kevalmorabia97
added a commit
that referenced
this pull request
Sep 8, 2026
…2341) ### What does this PR do? Type of change: Bug fix Raises the `puzzletron` extra's Hydra minimum from `==1.3.2` to `~=1.3.4`, picking up the `hydra.utils.instantiate()` target blocking added in Hydra 1.3.4 for CVE-2026-68508. **Are we affected?** Not exploitable in practice, but the vulnerable code was in the dependency tree. ModelOpt calls `hydra.utils.instantiate()` in four places, all inside `modelopt/torch/puzzletron`: - `modelopt/torch/puzzletron/entrypoint.py:58` - `modelopt/torch/puzzletron/scoring.py:82` - `modelopt/torch/puzzletron/puzzletron_nas_plugin.py:126` and `:227` In every case the config is composed by `initialize_hydra_config_for_dir()` from a local directory path the caller supplies, and the only overrides ModelOpt injects are the fixed `puzzle_dir` and `dataset_path`. Nothing reads a Hydra config out of model metadata, a checkpoint, or any downloaded artifact, which is the model-loader scenario the advisory calls out. Every `_target_` in the shipped `examples/puzzletron/configs/` resolves to a ModelOpt descriptor or pruning mixin class. Two things worth recording for future readers: - `modelopt/torch/puzzletron/scoring.py` is decorated with `@hydra.main`, so running it directly accepts arbitrary CLI overrides such as `+x._target_=os.system`. That crosses no privilege boundary since the operator can already run Python. - `modelopt/torch/puzzletron/tools/hydra_utils.py:102` registers a `${get_object:...}` OmegaConf resolver that imports arbitrary dotted paths during `OmegaConf.resolve`. The 1.3.4 fix does not cover that resolver, so it remains an equivalent gadget under the same assumption: a Hydra config directory is trusted input, equivalent to executable code. **Why `~=1.3.4` and not `~=1.3.0`:** the compatible-release form `~=1.3.0` would still admit 1.3.0 through 1.3.3, which are the vulnerable releases. `~=1.3.4` means `>=1.3.4,<1.4.0`, so it enforces the fix while keeping us off the 1.4 line. `uv.lock` is intentionally not regenerated here; it still pins `hydra-core==1.3.2`. The weekly `bump_uv_lock.yml` job will pick up the new constraint. ### Usage ```python # No user-facing API change. Install the puzzletron extra as usual: # pip install "nvidia-modelopt[puzzletron]" ``` ### Testing Verified in a clean throwaway venv, not in the repo environment: - `pip install "hydra-core~=1.3.4"` resolves to 1.3.6, the current stable release. - Confirmed 1.3.6 ships `hydra/_internal/target_policy.py`, absent in 1.3.2, and that 1.3.2's `_resolve_target` has no target checks. - Confirmed the new policy is a **blocklist** of specific dangerous callables, not a deny-by-default allowlist, so third-party targets such as our `modelopt.torch.puzzletron.*` descriptors are unaffected. This was the main compatibility risk of the bump. - Smoke-tested `instantiate()` on 1.3.6: benign targets (`collections.OrderedDict`, `pathlib.Path`) instantiate normally, while `builtins.eval` raises `InstantiationException`. - Confirmed no `_target_` value in `examples/puzzletron/configs/` appears in `DEFAULT_BLOCKLISTED_MODULES` or `UNCONTROLLED_EXECUTION_TARGETS`. I did not run the puzzletron pipeline end to end against 1.3.6; it needs multi-GPU and a model checkpoint. ### Before your PR is "*Ready for review*" - Is this change backward compatible?: ✅ - If you copied code from any other sources or added a new PIP dependency, did you follow guidance in `CONTRIBUTING.md`: N/A - Did you write any new necessary tests?: N/A - Did you update [Changelog](https://github.com/NVIDIA/Model-Optimizer/blob/main/CHANGELOG.rst)?: ❌ — dependency floor bump with no user-facing behavior change. - Did you get Claude approval on this PR?: N/A ### Additional Information Advisory: CVE-2026-68508, fixed in hydra-core 1.3.4. Latest stable is 1.3.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated an optional dependency to a compatible Hydra Core 1.3.x release range. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Keval Morabia <28916987+kevalmorabia97@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Type of change: Bug fix
Raises the
puzzletronextra's Hydra minimum from==1.3.2to~=1.3.4, picking up thehydra.utils.instantiate()target blocking added in Hydra 1.3.4 for CVE-2026-68508.Are we affected? Not exploitable in practice, but the vulnerable code was in the dependency tree. ModelOpt calls
hydra.utils.instantiate()in four places, all insidemodelopt/torch/puzzletron:modelopt/torch/puzzletron/entrypoint.py:58modelopt/torch/puzzletron/scoring.py:82modelopt/torch/puzzletron/puzzletron_nas_plugin.py:126and:227In every case the config is composed by
initialize_hydra_config_for_dir()from a local directory path the caller supplies, and the only overrides ModelOpt injects are the fixedpuzzle_diranddataset_path. Nothing reads a Hydra config out of model metadata, a checkpoint, or any downloaded artifact, which is the model-loader scenario the advisory calls out. Every_target_in the shippedexamples/puzzletron/configs/resolves to a ModelOpt descriptor or pruning mixin class.Two things worth recording for future readers:
modelopt/torch/puzzletron/scoring.pyis decorated with@hydra.main, so running it directly accepts arbitrary CLI overrides such as+x._target_=os.system. That crosses no privilege boundary since the operator can already run Python.modelopt/torch/puzzletron/tools/hydra_utils.py:102registers a${get_object:...}OmegaConf resolver that imports arbitrary dotted paths duringOmegaConf.resolve. The 1.3.4 fix does not cover that resolver, so it remains an equivalent gadget under the same assumption: a Hydra config directory is trusted input, equivalent to executable code.Why
~=1.3.4and not~=1.3.0: the compatible-release form~=1.3.0would still admit 1.3.0 through 1.3.3, which are the vulnerable releases.~=1.3.4means>=1.3.4,<1.4.0, so it enforces the fix while keeping us off the 1.4 line.uv.lockis intentionally not regenerated here; it still pinshydra-core==1.3.2. The weeklybump_uv_lock.ymljob will pick up the new constraint.Usage
Testing
Verified in a clean throwaway venv, not in the repo environment:
pip install "hydra-core~=1.3.4"resolves to 1.3.6, the current stable release.hydra/_internal/target_policy.py, absent in 1.3.2, and that 1.3.2's_resolve_targethas no target checks.modelopt.torch.puzzletron.*descriptors are unaffected. This was the main compatibility risk of the bump.instantiate()on 1.3.6: benign targets (collections.OrderedDict,pathlib.Path) instantiate normally, whilebuiltins.evalraisesInstantiationException._target_value inexamples/puzzletron/configs/appears inDEFAULT_BLOCKLISTED_MODULESorUNCONTROLLED_EXECUTION_TARGETS.I did not run the puzzletron pipeline end to end against 1.3.6; it needs multi-GPU and a model checkpoint.
Before your PR is "Ready for review"
CONTRIBUTING.md: N/AAdditional Information
Advisory: CVE-2026-68508, fixed in hydra-core 1.3.4. Latest stable is 1.3.6.
🤖 Generated with Claude Code
Summary by CodeRabbit