CVE-2026-57516High· 8.8▾ MidnightPoC availableRay prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_dec…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
0.6% → 0.9%
8.8 → —
— → 8.8
none → high
8.8 → —
high → none
— → 8.8
none → high
8.8 → —
high → none
— → 8.8
none → high
Exploit / PoC code exists
Last analysed / modified upstream
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
ray < 2.56.0Upgrade past the affected range:
ray 2.56.0Affected packages:
ray < 2.56.0Patched in:
ray 2.56.0Source: https://osv.dev/vulnerability/GHSA-hhrp-gw25-jr43
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32981High· 7.5A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1
CVE-2025-62593High· 8.8Ray is an AI compute engine
CVE-2023-6019Critical· 9.8Ray OS Command Injection vulnerability
CVE-2023-48022Critical· 9.8Ray has arbitrary code execution via jobs submission API
CVE-2023-6020Critical· 9.3Ray Missing Authorization vulnerability
CVE-2023-6021Critical· 9.3Ray Path Traversal vulnerability