Ray-Project Ray Code Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.4Security Advisory

TL;DR 📌

  • Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.
  • Highest CVSS: 9.4 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-62593.

What it is

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

For leadership 🧭

Executive summary. Ray, used by developers as part of their local or shared development workflow, can be tricked into executing attacker-supplied code via Firefox or Safari, and this is already happening in the wild. Given the critical severity and confirmed exploitation, this needs urgent attention rather than routine patch scheduling.

Why it matters:

  • Ray is typically run on developer workstations or shared development clusters, so a compromise here can expose source code, credentials and any data those environments touch.
  • The attack path runs through the browser (Firefox or Safari), meaning exploitation does not require direct network access to Ray’s ports — a developer simply browsing the web could trigger it.
  • This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, confirming active exploitation rather than theoretical risk.
  • A CVSS score of 9.4 reflects that successful exploitation gives full remote code execution with high impact on confidentiality, integrity and availability.

Now / Next / Later:

  • Now: Identify every machine and cluster running Ray as a development tool and check the vendor advisory for the fixed release to apply immediately.
  • Next: During the next change window, isolate or restrict network access to Ray instances that cannot yet be patched, and advise affected developers to avoid using Firefox or Safari on those machines until updated.
  • Later: Establish a process to track Ray and other developer-tooling dependencies against CISA KEV so exploited vulnerabilities in local development infrastructure are caught and patched as quickly as production systems.

Source