Ray has arbitrary code execution via jobs submission API

CRITICAL 9.8CVE-2023-48022 · GHSA-6wgj-66m2-xxp2 · PYSEC-2026-517 · Published 28/11/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
ray PyPI	`≤ 2.49.2`	No fix yet
ray anyscale	`= 2.6.3= 2.8.0`	No fix yet

Description

Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment.

NVD description

Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)

References

nvd.nist.gov/vuln/detail/CVE-2023-48022 · ADVISORY
ray-project/ray commit 9789470 · WEB
atlas.mitre.org/studies/AML.CS0023 · WEB
bishopfox.com/blog/ray-versions-2-6-3-2-8-0 · WEB
console.vulncheck.com/cve/CVE-2023-48022 · WEB
docs.ray.io/en/latest/ray-security/index.html · WEB
docs.ray.io/en/latest/ray-security/token-auth.html · WEB
GitHub Advisory GHSA-xg2h-7cxj-3gvh · ADVISORY
honysyang/Ray · WEB
ray-project/ray · PACKAGE
anyscale.com/blog/update-on-ray-cve-2023-48022-new-verification-tooling-available · WEB
oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild · WEB
vicarius.io/vsociety/posts/shadowray-cve-2023-48022-exploit · WEB
vicarius.io/vsociety/posts/the-story-of-shadowray-cve-2023-48022 · WEB
vulncheck.com/blog/initial-access-intelligence-august-2024 · WEB
pypi.org/project/ray · PACKAGE
GitHub Advisory GHSA-6wgj-66m2-xxp2 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free