Detections
Analytics
CVE-2025-62593
critical
Description
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
References
https://github.com/B1ack4sh/Blackash-CVE-2025-62593
https://github.com/Ashwesker/Blackash-CVE-2025-62593
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593
https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v
https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09
Details
Published: 2025-11-26
Updated: 2026-08-18
Known Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: Critical
CVSS v3
Base Score: 8.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: High
CVSS v4
Base Score: 9.4
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Severity: Critical
EPSS
EPSS: 0.16888
Vulnerability Watch
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability of Interest