CISA has added a critical Ray-Project Ray vulnerability, tracked as CVE-2025-62593, to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The flaw can allow remote code execution on systems where vulnerable Ray development environments are running.
Ray is an open-source distributed computing framework widely used by Python developers and AI teams for scaling machine learning, data processing, and application workloads.
The issue affects Ray versions before 2.52.0 and is especially dangerous for developers using Firefox or Safari. At the same time, Ray is active on their local workstation or development server. The Ray Project addressed the vulnerability in version 2.52.0.
CVE-2025-62593 stems from insufficient protections for Ray HTTP API endpoints, including job-related endpoints that can accept requests that can launch code.
Ray attempted to block browser-based access by checking whether the User-Agent header began with “Mozilla.” However, this was not a reliable security boundary.
Ray-Project Ray Code Injection Vulnerability Exploited
In Firefox and Safari, attackers can manipulate the User-Agent value through browser request behavior, allowing them to bypass the intended filter.
An attacker can exploit this weakness in combination with DNS rebinding. This technique tricks a victim’s browser into communicating with local or internal services.
In a likely attack scenario, a developer running an outdated Ray instance visits a malicious website or encounters a malicious advertisement.
The attacker-controlled page could then send requests to the Ray service on the developer’s machine and trigger arbitrary code execution with the privileges of the Ray process. The vulnerability is associated with CWE-94, improper control of code generation, and CWE-352, cross-site request forgery.
While user interaction is required, the attack does not require the attacker to have access to the target Ray environment already. This makes browser exposure a major concern for developers who run Ray locally while browsing the web.
CISA added the flaw to the KEV catalog on August 17, 2026, with a remediation due date of August 20, 2026. The agency’s listing confirms that the vulnerability has been exploited. However, it does not identify ransomware use or disclose details about the attacks, victims, or threat actors.
Organizations should immediately identify Ray installations across developer endpoints, build servers, container images, and cloud-based compute environments.
Teams should upgrade to Ray 2.52.0 or later, rebuild images that contain older dependencies, and confirm that package management tools have not retained a vulnerable Ray release.
Where immediate patching is not possible, Ray dashboards and APIs should not be exposed to untrusted networks. Security teams should restrict access through network segmentation, authenticated proxies, VPNs, and firewall rules.
They should also review logs for unexpected job submissions, unusual API requests, suspicious browser activity, or unapproved commands executed by Ray processes.
CISA advises stakeholders to apply vendor mitigations, assess each asset’s internet exposure, and follow applicable BOD 26-04 risk-based update guidance. Organizations unable to apply effective mitigations should consider discontinuing use of affected Ray deployments until they can securely upgrade.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.