Hydra, a framework for configuring complex applications, stored legacy instantiate target blocklists and execution‑policy collections in mutable module‑level state from versions 1.3.4 through 1.3.6, exposing a path for attackers to modify the blocklist by removing denied targets and then executing them. This mutation persists in global process state and can allow code execution with the application’s privileges. The weakness involves uncontrolled input influencing executable commands and improper data handling.

Hydra versions 1.3.4, 1.3.5, and 1.3.6 are affected. The issue is fixed in Hydra 1.3.7 and in Hydra 1.4.0.dev10 or later releases.

Based on the description, it is inferred that the attacker must be able to supply or modify configuration inputs that create multiple sibling target entries, thereby allowing removal of denied targets. The likely attack vector is an authorized configuration change or a locally privileged user creating such entries. The CVSS score of 8.5 signals high severity, while the EPSS score is not available and KEV listing is empty, indicating the vulnerability remains potentially exploitable. If exploited, the attacker could trigger code execution with the application’s privileges, effectively gaining control over the system.