Ray-project vulnerabilities
We track 5 vulnerabilities in Ray-project products across 2 products. 5 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on May 8, 2026.
Latest Ray-project vulnerabilities
- 8.8 High severity
ray: Improper Control of Generation of Code
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parque
- 7.5 High severity
Ray: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences
- 8.8 High severity
Ray-Project Ray Code Injection Exploited
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-bas
- 7.5 High severity
ray-project/ray: Improper Limitation of a Pathname to a Restricted Directory
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-602
- 9.8 Critical severity
ray-project/ray: Improper Neutralization of Special Elements used in an OS Command
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: