Ray < 2.52.0 Remote Code Execution (CVE-2025-62593)

The Ray Dashboard service running on the remote host is prior to version 2.52.0. It is, therefore, affected by a remote code execution vulnerability: - Ray's browser-based attack protection relies solely on checking that the User-Agent header starts with 'Mozilla'. The Fetch specification allows...

modin (>=0.1.0, <=0.1.1) potentially affected by CVE-2025-62593 via ray (0.5.0)

ray PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - modin =0.1.0, =0.1.1 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

auto-augment (1.0.0), bio-pyminer (>=0.9.13, <=0.10.0) +3 more potentially affected by CVE-2025-62593 via ray (0.8.4)

ray PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - auto-augment 1.0.0 - bio-pyminer =0.9.13, =0.0.0, =0.4.7, =0.4.9 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

biome-text (>=3.0.0, <=3.2.1), deepcomp (>=1.2.4, <=1.2.5) +7 more potentially affected by CVE-2025-62593 via ray (1.3.0)

ray PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - biome-text =3.0.0, =1.2.4, =0.4.2rc0, =0.0.7, =0.2.0, =2021.6.12.dev0, =2021.6.17.dev0 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

farm-haystack (>=0.10.0, <=1.0.0), kserve (>=0.7.0rc0, <=0.7.0) potentially affected by CVE-2025-62593 via ray (1.5.0)

ray PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - farm-haystack =0.10.0, =0.7.0rc0, =0.7.0 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

flambe (>=0.4.11, <=0.4.13) potentially affected by CVE-2025-62593 via ray (0.7.6)

ray PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flambe =0.4.11, =0.4.13 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

aana (>=0.2.1, <=0.2.4), ablator (>=0.0.1b1, <=0.0.1b3) +501 more potentially affected by CVE-2025-62593 via ray (>=0.5.0, <=2.51.1)

ray PYPI version =0.5.0, =0.2.1, =0.0.1b1, =0.1.1, =0.2.0, =0.0.3, =1.0.4, =1.3.0, =1.0.1, =1.0.3, =2.0.3, =2.0.3, =2.0.10 and more Source cves: CVE-2025-62593 Source advisory: MEND:CVE-2025-62593...

autogluon (>=0.4.1b20220318, <=0.4.3), autotst (>=1.0.0, <=1.2.0) +7 more potentially affected by CVE-2025-62593 via ray (1.10.0)

ray PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - autogluon =0.4.1b20220318, =1.0.0, =0.0.1, =0.0.0, =0.1.0, =1.7.8, =0.1.5, =0.1.6 Source cves: CVE-2025-62593 Source advisory: OSV:GHSA-Q279-JHRF-CC6V...

flambe (>=0.4.11, <=0.4.13) potentially affected by CVE-2025-62593 via ray (0.7.6)

ray PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - flambe =0.4.11, =0.4.13 Source cves: CVE-2025-62593 Source advisory: OSV:GHSA-Q279-JHRF-CC6V...

aana (>=0.2.1, <=0.2.4), ablator (>=0.0.1b1, <=0.0.1b3) +418 more potentially affected by CVE-2025-62593 via ray (>=2.0.0, <=2.51.1)

ray PYPI version =2.0.0, =0.2.1, =0.0.1b1, =0.2.0, =1.0.4, =1.3.0, =1.0.1, =1.0.3, =2.0.3, =2.0.3, =1.6.0, =1.4.0, =1.15.2 and more Source cves: CVE-2025-62593 Source advisory: GHSA-Q279-JHRF-CC6V...

encdecmeta (0.0.3), nevopy (>=0.0.1, <=0.2.3) potentially affected by CVE-2025-62593 via ray (1.1.0)

ray PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - encdecmeta 0.0.3 - nevopy =0.0.1, =0.2.3 Source cves: CVE-2025-62593 Source advisory: OSV:GHSA-Q279-JHRF-CC6V...

CVE-2025-62593

creationtimestamp| type| source ---|---|--- 2025-11-26 17:19:39+00:00| published-proof-of-concept| https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v 2025-11-27 00:02:56+00:00| seen| https://infosec.exchange/users/offseq/statuses/115618727470423566 2025-11-27 00:02:57+00:0...