PT-2026-53589 · Pypi · Ray

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection exists in Ray's cpu profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

Correção

Identificadores relacionados

PYSEC-2026-519

Produtos afetados

Ray

Referências · 8

• https://github.com/ray-project/ray · Nota
• https://github.com/ray-project/ray/releases/tag/ray-2.8.1 · Nota
• https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6019 · Nota de Segurança
• https://anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-519 · Aviso do Fabricante
• https://github.com/advisories/GHSA-h3xg-wv58-5p43 · Nota
• https://pypi.org/project/ray · Nota