PT-2026-37117 · Anyscale · Ray

Shakevsky · Published 2026-04-24 · Updated 2026-05-09 · CVE-2026-41486

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Ray versions 2.49.0 through 2.54.0

Description Ray Data registers custom Arrow extension types (ray.data.arrow tensor, ray.data.arrow tensor v2, and ray.data.arrow variable shaped tensor) globally in PyArrow. When PyArrow reads a Parquet file containing these extension types, it invokes the arrow ext deserialize function on the metadata bytes of the field. The implementation passes these bytes directly to cloudpickle.loads(), which allows for arbitrary code execution during schema parsing before any row data is processed. This affects any process using Ray Data that reads Parquet files, including those using ray.data.read parquet(), pyarrow.parquet.read table(), or pandas.read parquet(). An attacker can exploit this by providing a crafted Parquet file containing a column with one of the affected extension type names.

Recommendations Update Ray to version 2.55.0.

Fix

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

CVE-2026-41486

ECHO-E817-9967-6723

GHSA-MW35-8RX3-XF9R

Affected Products

Ray

References · 9

• https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r · Vendor Advisory
• https://github.com/ray-project/ray/pull/62056 · Patch
• https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f · Patch
• https://osv.dev/vulnerability/GHSA-mw35-8rx3-xf9r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41486 · Security Note
• https://github.com/ray-project/ray · Note
• https://github.com/ray-project/ray/releases/tag/ray-2.55.0 · Note
• https://github.com/ray-project/ray/pull/54831 · Note
• https://twitter.com/CVEnew/status/2053131433833795913 · Twitter Post