Is ray safe ? 11 known vulnerabilities, worst severity CRITICAL.
// reach 54 direct dependencies
21 carry known advisories, worst CRITICAL
101 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss severity band, no base score published
epss chance of exploitation in 30 days
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-gx77-xgc2-4888, the advisory selected below
// 11 advisories GHSA-gx77-xgc2-4888 Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOT CRIT GHSA-q279-jhrf-cc6v Developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. KEV CRIT GHSA-6wgj-66m2-xxp2 Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. CRIT GHSA-3pww-qvr8-6mhp LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 CRIT GHSA-h3xg-wv58-5p43 A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. CRIT GHSA-6cxr-8q3m-jwrr LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 CRIT GHSA-hhrp-gw25-jr43 ray.data.read_webdataset(paths=...) is a @PublicAPI(stability="alpha") HIGH GHSA-mw35-8rx3-xf9r Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code exe HIGH GHSA-j3mh-qmjj-xp83 A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure. HIGH GHSA-q5fh-2hc8-f6rq Ray’s dashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can MODE GHSA-w4rh-fgx7-q63m Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. MODE Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.
Checked 2026-11-06 at 22:26 UTC. The most recent advisory here was published 2026-07-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page