Ray 代码注入漏洞

Ray is an open-source framework developed by ray-project, designed to extend AI and Python applications. Versions of Ray from 2.54.0 to 2.55.0 contained a code injection vulnerability. This vulnerability occurred when the PyArrow library read Parquet files by invoking arrowextdeserialize, allowin...

Ray 路径遍历漏洞

Ray is an open-source framework developed by ray-project, designed to extend AI and Python applications. Versions of Ray prior to 2.8.1 contained a path traversal vulnerability. This vulnerability stemmed from improper validation and cleaning of paths provided by users during the static file...

ShadowRay 2.0 Exploits Unpatched Ray Flaw to Build Self-Spreading GPU Cryptomining Botnet

Oligo Security has warned of ongoing attacks exploiting a two-year-old security flaw in the Ray open-source artificial intelligence AI framework to turn infected clusters with NVIDIA GPUs into a self-replicating cryptocurrency mining botnet. The activity, codenamed ShadowRay 2.0 , is an evolution...

ray 日志信息泄露漏洞

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. A security vulnerability exists in versions of ray prior to 2.43.0 that stems from the insertion of sensitive information into a log file, which could lead to the disclosure of redis passwords...

GHSA-XG2H-7CXJ-3GVH Withdrawn Advisory: Command injection in Ray

Withdrawn Advisory This advisory is a duplicate of GHSA-6wgj-66m2-xxp2 / CVE-2023-48022. Original Description An issue in Anyscale Inc Ray between v.2.9.3 and v.2.40.0 allows a remote attacker to execute arbitrary code via a crafted script...

Ray Security breach

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. A security vulnerability exists in Ray version 2.6.3, 2.8.0. An attacker exploited the vulnerability to perform a server-side request forgery attack...

Ray Operating System Command Injection Vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray suffers from an OS command injection vulnerability that stems from a command injection vulnerability in the cpuprofile URL parameter. An attacker can exploit this vulnerability to run the Ray...