Ray’s WebDataset reader can ingest tar archives that contain .pkl, .pickle, .pt, or .pth files. The default decoder function calls pickle.loads() on .pkl/.pickle entries and torch.load() with weights_only=False on .pt/.pth entries without any validation. When an attacker crafts a malicious tar file and supplies it to read_webdataset(), the deserialization step executes arbitrary code inside each Ray worker that processes the archive. This unsafe deserialization flaw is classified as CWE‑502 and gives attackers remote code execution on all workers that ingest the malicious data.

All installations of Ray from Anyscale, Inc. with a version earlier than 2.56.0 are vulnerable. The issue cluster the dataset ingestion.

The CVSS score of 8.6 indicates high severity because arbitrary code can run on any worker calling read_webdataset(). The EPSS score of less than 1% suggests a low probability of exploitation at present, although the flaw would be easy to exploit if a Ray cluster processes untrusted tar files. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. The likely attack vector is a malicious tar archive sent to a component that invokes read_webdataset(), leading to Ray cluster.