{"id":"CVE-2026-57516","published":"2026-07-01T16:36:55Z","modified":"2026-10-08T15:23:28Z","title":"Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader","vendor":"Anyscale, Inc","product":"Ray","tier":"tail","description":{"text":"Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00858,"percentile":0.58317,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://github.com/ray-project/ray/releases/tag/ray-2.56.0","tags":["release-notes"]},{"url":"https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43","tags":["vendor-advisory"]},{"url":"https://github.com/ray-project/ray/pull/63469","tags":["patch","issue-tracking"]},{"url":"https://github.com/ray-project/ray/pull/63470","tags":["patch","issue-tracking"]},{"url":"https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader","tags":["third-party-advisory"]}],"priority":{"score":17.8,"factors":[{"name":"EPSS percentile","points":11.66},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"anyscale","affectedVersions":[{"vendor":"Anyscale, Inc","product":"Ray","versions":["< 2.56.0"]}],"affected":[{"ecosystem":"PyPI","package":"ray","vulnerableRanges":["<2.56.0"],"patched":["2.56.0"],"from":["GHSA-hhrp-gw25-jr43","PYSEC-2026-2273"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-41089","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-62593","published":"2025-11-26","fixed":"2.52.0","kev":true},{"cve":"CVE-2026-27482","published":"2026-02-21","fixed":"2.54.0","kev":false},{"cve":"CVE-2026-41486","published":"2026-05-08","fixed":"2.55.0","kev":false,"link":{"from":"CVE-2026-41486","to":"CVE-2026-57516","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ray","fromFixed":"2.55.0","toFixed":"2.56.0","daysApart":54}]}},{"cve":"CVE-2026-57516","published":"2026-07-01","fixed":"2.56.0","kev":false}],"package":"PyPI:ray"}}