CVE-2026-41486

Katalog CVE

CVSS 8.8 · High EPSS 0,70%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada anyscale ray. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r advisory vendor
• https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f patch
• https://github.com/ray-project/ray/pull/62056 issue tracking · patch
• https://github.com/ray-project/ray/releases/tag/ray-2.55.0 product · release notes