Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Exploitation poc

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
ray-project ray affected
Version Status Constraints
< 2.52.0 affected
—

No data.

No data.

Vendor Product Confidence Versions
Ray Project Ray — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Ray Project Subscribe
Ray Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q279-jhrf-cc6v Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09 cve-icon cve-icon cve-icon
https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-62593 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-62593 cve-icon
History

Mon, 01 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Fri, 28 Nov 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 27 Nov 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Ray Project
Ray Project ray
Vendors & Products Ray Project
Ray Project ray

Wed, 26 Nov 2025 22:45:00 +0000

Type Values Removed Values Added
Description Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
Title Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Weaknesses CWE-352
CWE-94
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-11-28T18:22:23.915Z

Reserved: 2025-10-16T19:24:37.266Z

Link: CVE-2025-62593

cve-icon Vulnrichment

Updated: 2025-11-28T18:22:05.838Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-11-26T23:15:47.927

Modified: 2025-12-01T15:39:33.110

Link: CVE-2025-62593

cve-icon Redhat

Severity : Important

Publid Date: 2025-11-26T22:28:28Z

Links: CVE-2025-62593 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-11-27T16:26:29Z

Weaknesses