facebookresearch vulnerabilities

Products

• hydra 1
• ParlAI 1

Latest facebookresearch CVEs

Newest publication first

1. CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

   Published 2026-08-21

   High·CVSS 7.8 EPSS 0.46%

   Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled targe...

2. CVE-2021-24040 Deserialization of Untrusted Data in parlai

   Published 2021-09-10

   High·CVSS 8.8 EPSS 17.4% Public exploit

   parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.