Remote Code Execution Vulnerability in Ray AI Compute Engine
CVE-2025-62593

9.4CRITICAL

Key Information:

Vendor

Ray-project

Status
Ray
Vendor
CVE Published:
26 November 2025

What is CVE-2025-62593?

Ray AI Compute Engine, widely utilized as a development tool, contains a significant RCE vulnerability in versions prior to 2.52.0. This vulnerability arises from a failure to properly safeguard against browser-based attacks. The existing defense mechanism inadequately relies on the User-Agent header, which can easily be manipulated according to the fetch specification. As a result, developers using Ray could be exploited through a malicious website visit or harmful advertisements, particularly when using browsers like Firefox and Safari. It is recommended to upgrade to version 2.52.0 or newer to mitigate these security risks.

Affected Version(s)

ray < 2.52.0

References

https://github.com/ray-project/ray/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/ray-project/ray/commit/70e7c72780bdec0...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.