1474 matches found
CVE-2023-48022
CVE-2023-48022 CVE-2023-48022 exploit modified from Bishop Fox work How to use set ip and port in jobs.py set payload in malicious.py $ pip install ray $ python3 jobs.py...
Presentations
Presentations Presentation| Slides| Video ---|---|--- BlueHat IL 2020 - Trinity: PSP Emulator Escape| 2020-BlueHatIL-Trinity.pdf| https://www.youtube.com/watch?v=J0OQsDTyAL8 Hardwear.io USA 2022 - bd-jb: Blu-ray Disc Java Sandbox Escape| 2022-hardwear-io-bd-jb.pdf|...
mcp-xray
MCP X-Ray !NOTE Looking to secure AI agent skills? Check out Skill X-Ray, an open-source static security scanner that analyzes skill packages for malicious or risky behavior before installation, without executing them. Overview MCP X-Ray is a unified open-source security scanning and penetration...
ShadowRay-RCE-PoC-CVE-2023-48022
PoC for a remote command execution vulnerability in Ray framework CVE-2023-48022 This exploit script and PoC are written for an in-depth CVE analysis on vsociety. The Ray framework, an essential tool for Python-based AI and machine learning applications, has encountered a significant security...
CVE-2025-62593-PoC
CVE-2025-62593 — Ray Remote Code Execution unauthenticated Proof-of-concept for CVE-2025-62593 , an unauthenticated Remote Code Execution vulnerability in the Ray distributed AI compute engine, abused via browser-based DNS-rebinding attacks. It was added to the CISA Known Exploited Vulnerabilitie...
CVE-2023-6019
CVE-2023-6019 - Anyscale Ray Dashboard Unauthenticated RCE PoC exploit for CVE-2023-6019 — Remote Code Execution via unauthenticated Ray Dashboard Jobs API. Made by oguiii Description Anyscale Ray is an open-source framework for distributed ML/AI workloads. Versions prior to 2.6.4 expose a Jobs...
CVE-2023-6019
Ray OS Command Injection RCEUnauthorized Usage: 1. nc -lvnp 4444 2. python3 cve-2023-6019.py -t 192.168.1.13 -p 80 -L 192.168.1.14 -P 80...
CVE-2026-33017
CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview CVE-2025-62593 is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine. The root cause is the absence of authentication on critical HTTP endpoints /api/jobs, /api/jobagent/jobs. An attacker can...
Ray Static File - Local File Inclusion
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. id: CVE-2023-6020 info: name: Ray Static File - Local File Inclusion author: byt3bl33d3r severity: high description: | LFI in Ray's /static/ directory allows attackers to read any file on the...
Ray API - Local File Inclusion
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. id: CVE-2023-6021 info: name: Ray API - Local File Inclusion author: byt3bl33d3r severity: high description: | LFI in Ray's log API endpoint allows attackers to read any file on the server withou...
Anyscale Ray - Remote Code Execution
Anyscale Ray 2.6.3 and 2.8.0 contain a remote code execution vulnerability due to insecure job submission API, allowing attackers to execute arbitrary code remotely if they have network access to the Ray Dashboard API. id: CVE-2023-48022 info: name: Anyscale Ray - Remote Code Execution author:...
Ray < 2.52.0 - Remote Code Execution
Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic rejecting Mozilla-prefixed headers can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable. i...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113717 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113717 Source advisory: OSV:GHSA-CX28-75Q4-X26Q...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113714 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113718 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113718 Source advisory: OSV:GHSA-394H-QWMC-48PF...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113720 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113720 Source advisory: OSV:GHSA-FC2G-4W5P-6WHM...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113723 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113723 Source advisory: OSV:GHSA-6W3R-XR62-4XCP...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113715 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...
cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113719 via virtualenv (16.7.10)
virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...