CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability

EPSS trend

Probability

62.46%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+45.57 pp

From 16.89% on 18-09-2026

18-09-202618-10-2026

EPSS score

62.46%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 17-08-2026
Federal due date: 20-08-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09 nvd.nist.gov/vuln/detail/CVE-2025-62593

Public exploits

1 found

githubUnverified
Ray
Maturity: poc

References

14 links

github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6vX Refsource CONFIRMWEBAdvisoryExploitPatchVendor Advisory
github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09X Refsource MISCWEBFIXPatch
www.bitsight.com/blog/rondodox-botnet-infrastructure-analysisThird Party AdvisoryAdvisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593Government ResourceWEBUS Government Resource
nvd.nist.gov/vuln/detail/CVE-2025-62593Advisory
github.com/nccgroup/singularity/pull/68WEB
docs.ray.io/en/releases-2.51.1/ray-security/index.htmlWEB
en.wikipedia.org/wiki/MalvertisingWEB
github.com/ray-project/rayPACKAGE
github.com/ray-project/…WEB

Show all 14 references

github.com/ray-project/…WEB
pypi.org/project/rayPACKAGE
github.com/advisories/GHSA-q279-jhrf-cc6vAdvisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62593.jsonAdvisory

Related vulnerabilities

CVE-2026-41486anyscaleray+50.70%5mo ago08-05-2026 21:46Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.CVE-2026-27482anyscaleray+70.41%8mo ago21-02-2026 09:18Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.CVE-2026-57516anyscale, incray+40.86%3mo ago01-07-2026 16:36Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.CVE-2026-32981anyscaleray+21.07%7mo ago17-03-2026 19:33A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.CVE-2023-48023anyscaleray35.30%2y ago28-11-2023 00:00Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment CVE-2023-48022anyscaleray+1183.94%2y ago28-11-2023 00:00Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)

All vulnerabilities inray ray

CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References