Hydra-ray-launcher implements a configuration resolver that passes the value of the ray_pkg_version placeholder to importlib.import_module(). An attacker who can influence configuration values or command‑line overrides can cause the application to import an arbitrary module. Importing a module can trigger import‑time side effects, possibly leading to execution of untrusted code or modification of application state. The weakness is classified as arbitrary module import (CWE‑470).

The vulnerability exists in hydra‑ecosystem's hydra‑ray‑launcher. Versions before 1.2.2 in the 1.1.0 series and before 1.4.0rc2 in the 1.4.0 series are affected. Subsequent releases (1.2.2 and later or 1.4.0rc2 and later) contain the fix.

The CVSS score of 4.8 indicates a medium impact if exploitation succeeds. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is via configuration files or command‑line parameters that an attacker can modify, implying a local or remote attacker with that ability. No exploitation requirements beyond the ability to supply a ray_pkg_version value are stated, so once the input is controlled, the import operation can be executed almost immediately.