Ray’s WebDataset reader processes tar archives that may contain .pkl, .pickle, .pt, and .pth files. This is a CWE‑502 unsafe deserialization vulnerability. In versions prior to 2.56.0 the reader unconditionally deserializes these files using pickle.loads() or torch.load() without checking for malicious content. An attacker can embed arbitrary bytecode in such files so that when read_webdataset() is called a malicious archive is processed, leading to code execution under the privileges of any Ray worker that handles the archive. This grants an attacker full remote code execution on every worker that ingest the malicious archive, potentially compromising an entire Ray cluster.

All installations of Ray from Anyscale, Inc. with a version earlier than 2.56.0 are vulnerable. The issue primarily affects components that ingest WebDataset archives, including worker processes that invoke read_webdataset() on external or user‑supplied tar files.

The CVSS score of 8.6 reflects a high severity because arbitrary code can run on any Ray worker that calls read_webdataset(). The EPSS score of less than 1% indicates a low probability of exploitation at present, although the flaw would be easy to exploit if a malicious tar archive is sent to a component that invokes read_webdataset(), potentially compromising a Ray cluster. The vulnerability is not listed in the CISA KEV catalog.