Ray has arbitrary code execution via jobs submission API

🗓️ 28 Nov 2023 09:30:26Reported by GitHub Advisory DatabaseType

Anyscale Ray allows remote arbitrary code execution via the job submission interface.

Reporter	Title	Published	Views	Family All 54
GithubExploit	Exploit for Server-Side Request Forgery in Anyscale Ray	10 Jan 202406:26	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in Anyscale Ray	29 Mar 202409:54	–	githubexploit
0day.today	Ray Agent Job Remote Code Execution Exploit	27 Aug 202400:00	–	zdt
Chainguard	CVE-2023-48022 vulnerabilities	7 Jan 202601:30	–	cgr
Circl	CVE-2023-48022	17 Dec 202316:42	–	circl
CNNVD	Ray Code Issues Vulnerabilities	28 Nov 202300:00	–	cnnvd
CVE	CVE-2023-48022	28 Nov 202300:00	–	cve
Cvelist	CVE-2023-48022	28 Nov 202300:00	–	cvelist
Cvelist	CVE-2023-6021 Ray Log File Local File Include	16 Nov 202316:11	–	cvelist
Github Security Blog	Ray Path Traversal vulnerability	16 Nov 202318:30	–	github

Vulners

Node

ray_project rayRange≤2.49.2pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-48022
bishopfox	www.bishopfox.com/blog/ray-versions-2-6-3-2-8-0
docs	www.docs.ray.io/en/latest/ray-security/index.html
vicarius	www.vicarius.io/vsociety/posts/shadowray-cve-2023-48022-exploit
atlas	www.atlas.mitre.org/studies/AML.CS0023
github	www.github.com/ray-project/ray/commit/978947083b1e192dba61ef653c863b11d56b0936
console	www.console.vulncheck.com/cve/CVE-2023-48022
github	www.github.com/advisories/GHSA-xg2h-7cxj-3gvh
github	www.github.com/honysyang/Ray
anyscale	www.anyscale.com/blog/update-on-ray-cve-2023-48022-new-verification-tooling-available

20 Dec 2025 05:01Current

8High risk

Vulners AI Score8

CVSS 3.19.8

EPSS0.92192

SSVC