Synced 12 Sept 2026 01:32 UTC Account
← All products

CVE-2025-62593

HIGH severity · CVSS 8.8 · Code injection · actively exploited (CISA KEV)
8.8CVSS HIGH exploited
Actively exploited in the wild (CISA Known Exploited Vulnerabilities). Added to KEV 2026-08-17. US federal agencies must patch by 2026-08-20.

Summary

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

Impact & exploitability

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (1)

Ray

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

Official patch: https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09 ↗

Additional information