CISA added Ray vulnerability CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17 and listed an August 20 remediation date under its BOD 26-04 guidance. The browser-assisted code-injection flaw affects Ray versions before 2.52.0, giving teams that run Ray on developer systems or shared AI infrastructure an unusually short window to inventory and patch exposed installations.
CISA added CVE-2025-62593, a code-injection vulnerability in the Ray distributed-computing framework, to its Known Exploited Vulnerabilities catalog on August 17, 2026. The catalog entry says the decision is based on evidence of exploitation and lists August 20 as the remediation date under the agency's risk-based BOD 26-04 guidance.
Ray's project advisory says versions before 2.52.0 are affected. The issue can let a malicious website reach a locally running Ray dashboard through DNS rebinding and submit commands that result in remote code execution. The attack path is particularly relevant to developers using Firefox or Safari while Ray is running as a development tool.
Why the browser path matters
The vulnerable protection relied on checking whether a browser User-Agent began with Mozilla. Ray's advisory explains that this is insufficient because the Fetch specification permits the User-Agent header to be changed in the affected browsers. A developer who visits a malicious page or receives a malicious advertisement could therefore expose a local Ray service that was never intended to accept requests from the public internet.
The Ray maintainers fixed the flaw in version 2.52.0. CISA's KEV entry directs organizations to apply vendor mitigations, evaluate internet exposure, follow the BOD 26-04 implementation guidance, or discontinue the affected product when mitigations are unavailable. CISA does not identify the actor or campaign behind the exploitation in the catalog entry.
What AI platform teams should verify
For engineering teams, the immediate work is broader than checking production clusters. Ray can also appear on developer laptops, notebooks, CI workers, experiment hosts, and internal shared-compute systems. Teams should inventory those installations, upgrade affected versions, restrict access to Ray dashboard endpoints, and review the affected hosts for signs of unexpected job submission or command execution. The practical lesson is that a service bound to a local or internal interface is not automatically isolated from the browser. Developer-facing AI infrastructure needs the same authentication, network segmentation, least-privilege execution, and patch ownership expected of internet-facing services.
Key Points #
- 1CISA added CVE-2025-62593 to the KEV catalog on August 17 and listed August 20 as the remediation date under BOD 26-04 guidance.
- 2Ray versions before 2.52.0 can be exposed to browser-assisted remote code execution through DNS rebinding; version 2.52.0 contains the fix.
- 3Teams should check developer machines, notebooks, CI workers, and shared clusters because locally running Ray services can be reached through a malicious browser context.
Scoring Rationale #
CISA has confirmed exploitation of a critical code-injection flaw in a widely used AI compute framework and assigned a three-day remediation date. The affected browser-to-local-service path is directly relevant to developer workstations and shared ML infrastructure.
Sources #
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.