Ray-Project · Ray
Ray, an AI compute engine developed by Ray-Project, contains a critical code injection flaw in versions before 2.52.0, arising from a weak defense against browser-based attacks that relies on the User-Agent header beginning with "Mozilla". An attacker can achieve remote code execution on a developer's machine running Ray by luring them, via a malicious website or malvertising, to a page that uses DNS rebinding and a spoofed User-Agent, which requires the victim to visit the page in Firefox or Safari while Ray is running and involves no authentication.
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
First seen exploited 3 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 9 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in ray over 3 years. The latest fix listed for ray is 2.56.0.
Malicious website or malvertising drives browser-based exploitation
exploitable via Firefox and Safari
Achieves remote code execution on developer machine
critical RCE vulnerability exploitable via Firefox and Safari
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: ray.
Upgrade to 2.52.0 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2023-48022, CVE-2023-6019, +2).
pip install "ray>=2.52.0"The first fix for CVE-2025-62593.
| If you run | Upgrade to |
|---|---|
| All versions before 2.52.0 | 2.52.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.