# ray (PyPI) vulnerabilities 10 known vulnerabilities (3 critical, 5 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.60.0 (Nov 4, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2025-1979) can't be checked against versions - Newest unaffected release: 2.60.0 (Nov 4, 2026), the latest release, not counting 1 advisory without comparable ranges - Weekly downloads: 3.7M - Dependents: 642 - Releases: 137 since 0.1.1 - Registry: https://pypi.org/project/ray/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-57516: 0.1.1 to 2.55.1 (2.56.0 is outside it) - CVE-2026-41486: 0.1.1 to 2.54.1 (2.55.0 is outside it) - CVE-2026-32981: 0.1.1 to 2.8.0 (2.8.1 is outside it) - CVE-2026-27482: 0.1.1 to 2.53.0 (2.54.0 is outside it) - CVE-2025-62593: 0.1.1 to 2.51.2 (2.52.0 is outside it) - CVE-2025-1979: its ranges can't be placed on these versions - CVE-2023-48022: 0.1.1 to 2.49.2 (2.50.0 is outside it) - CVE-2023-6020: 0.1.1 to 2.8.0 (2.8.1 is outside it) - CVE-2023-6019: 0.1.1 to 2.8.0 (2.8.1 is outside it) - CVE-2023-6021: 0.1.1 to 2.8.0 (2.8.1 is outside it) ## Advisories (10) ### [CVE-2026-57516](https://cve.now/CVE-2026-57516): Ray \< 2.56.0 Unsafe Deserialization RCE via WebDataset Reader - Severity: High 8.6 - Published: Jul 1, 2026 - Affected: fixed in 2.56.0. - Fixed in 2.56.0 (released Jun 29, 2026, 2 days before disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2026-41486](https://cve.now/CVE-2026-41486): Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization - Severity: High 8.9 - Published: May 8, 2026 - Affected: through 2.54.0; from 2.49.0, fixed in 2.55.0. - Fixed in 2.55.0 (released Apr 15, 2026, 23 days before disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2026-32981](https://cve.now/CVE-2026-32981): Ray Dashboard \<= 2.8.0 Path Traversal Leading to Local File Disclosure - Severity: High 8.7 - Published: Mar 17, 2026 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released Dec 1, 2023, 837 days before disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2026-27482](https://cve.now/CVE-2026-27482): Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) - Severity: Medium 5.9 - Published: Feb 21, 2026 - Affected: fixed in 2.54.0. - Fixed in 2.54.0 (released Feb 18, 2026, 3 days before disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2025-62593](https://cve.now/CVE-2025-62593): Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack - Severity: Critical 9.4 · KEV - Published: Nov 26, 2025 - Affected: fixed in 2.52.0. - Fixed in 2.52.0 (released Nov 21, 2025, 5 days before disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2025-1979](https://cve.now/CVE-2025-1979): Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is… - Severity: Medium 5.7 - Published: Mar 6, 2025 - Affected: fixed in 2.43.0; fixed in 2.43.0. ### [CVE-2023-48022](https://cve.now/CVE-2023-48022): Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. - Severity: Critical 9.8 - Published: Nov 28, 2023 - Affected: through 2.49.2. - Fixed in 2.50.0 (released Oct 10, 2025, 682 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.60.0, is not affected. ### [CVE-2023-6020](https://cve.now/CVE-2023-6020): Ray Static File Local File Include - Severity: High 7.5 - Published: Nov 16, 2023 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released Dec 1, 2023, 15 days after disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2023-6019](https://cve.now/CVE-2023-6019): Ray Command Injection in cpu\_profile Parameter - Severity: Critical 9.8 - Published: Nov 16, 2023 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released Dec 1, 2023, 15 days after disclosure). - The latest release, 2.60.0, is not affected. ### [CVE-2023-6021](https://cve.now/CVE-2023-6021): Ray Log File Local File Include - Severity: High 7.5 - Published: Nov 16, 2023 - Affected: fixed in 2.8.1. - Fixed in 2.8.1 (released Dec 1, 2023, 15 days after disclosure). - The latest release, 2.60.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/ray Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.