CVE-2026-57516

Katalog CVE

CVSS 8.8 · High EPSS 0,86%

Kerentanan Deserialization of Untrusted Data pada anyscale ray. Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

Rincian

Terbit di NVD

1 Juli 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43 exploit · mitigasi · patch · advisory vendor
• https://github.com/ray-project/ray/pull/63469 issue tracking · patch
• https://github.com/ray-project/ray/pull/63470 issue tracking · patch
• https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader advisory pihak ketiga
• https://github.com/ray-project/ray/releases/tag/ray-2.56.0 product · release notes