Ray-Project Ray Code Injection Vulnerability
Ray-Project Ray has a code injection flaw enabling RCE, added to CISA KEV on August 18, 2026. Ray installs with browser-reachable interfaces are at risk. Federal patch deadline is August 21.
- Vendor
- Ray-Project
- Product
- Ray
- CVSS
- N/A
- EPSS (exploit probability)
- 0.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
CVE-2025-62593 is a code injection vulnerability in Ray, the open-source distributed computing framework widely used for ML training, inference, and data pipelines. The flaw enables remote code execution. Per the GitHub Security Advisory (GHSA-q279-jhrf-cc6v), the attack surface includes exposure via Firefox and Safari browsers.
CISA added this CVE to its Known Exploited Vulnerabilities catalog on August 18, 2026, confirming active exploitation in the wild. Under BOD 26-04, federal civilian agencies must remediate by August 21, 2026.
Patch: Apply the fix from commit 70e7c72 or update to the patched Ray release per the GitHub advisory. If no mitigation is available, CISA guidance is to discontinue use of the product.
Interim mitigation: Restrict access to the Ray dashboard (port 8265 by default) and any exposed Ray APIs to trusted networks only. Do not expose Ray web interfaces to the public internet.
See the 0dayNews full article for prioritization guidance.
