PT-2026-53589 · Pypi · Ray

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection exists in Ray's cpu profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

Fix

Related Identifiers

PYSEC-2026-519

Affected Products

Ray

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-6019 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-519 · Vendor Advisory
• https://github.com/ray-project/ray · Note
• https://github.com/ray-project/ray/releases/tag/ray-2.8.1 · Note
• https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe · Note
• https://anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 · Note
• https://github.com/advisories/GHSA-h3xg-wv58-5p43 · Note
• https://pypi.org/project/ray · Note