ray
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 22 advisory(ies) without a verdict
Advisories (22)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-3pww-qvr8-6mhp Ray Path Traversal vulnerability | < 2.8.1 | Undetermined |
| GHSA-6cxr-8q3m-jwrr Ray Missing Authorization vulnerability | < 2.8.1 | Undetermined |
| GHSA-6wgj-66m2-xxp2 Ray has arbitrary code execution via jobs submission API | ≤ 2.49.2 | Undetermined |
| GHSA-gx77-xgc2-4888 Ray's New Token Authentication is Disabled By Default | ≤ 2.52.0 | Undetermined |
| GHSA-h3xg-wv58-5p43 Ray OS Command Injection vulnerability | < 2.8.1 | Undetermined |
| GHSA-hhrp-gw25-jr43 Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False) | < 2.56.0 | Undetermined |
| GHSA-j3mh-qmjj-xp83 Ray Dashboard is vulnerable to path traversal through its static file handling mechanism | < 2.8.1 | Undetermined |
| GHSA-mw35-8rx3-xf9r Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization | 2.49.0 – < 2.55.0 | Undetermined |
| GHSA-q279-jhrf-cc6v Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack | < 2.52.0 | Undetermined |
| GHSA-q5fh-2hc8-f6rq Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) | < 2.54.0 | Undetermined |
| GHSA-w4rh-fgx7-q63m ray vulnerable to Insertion of Sensitive Information into Log File | < 2.43.0 | Undetermined |
| PYSEC-2025-23 Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the sta | < 64a2e4010522d60b90c389634f24df77b603d85d ; < 2.43.0 | Undetermined |
| PYSEC-2026-130 A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization o | < 2.8.1 | Undetermined |
| PYSEC-2026-2271 Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE end | < 2.54.0 | Undetermined |
| PYSEC-2026-2272 Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arro | ≤ 2.54.0 | Undetermined |
| PYSEC-2026-2273 Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplyin | < 2.56.0 | Undetermined |
| PYSEC-2026-515 Ray Path Traversal vulnerability | < 2.8.1 | Undetermined |
| PYSEC-2026-516 Ray Missing Authorization vulnerability | < 2.8.1 | Undetermined |
| PYSEC-2026-517 Ray has arbitrary code execution via jobs submission API | ≤ 2.49.2 | Undetermined |
| PYSEC-2026-518 Ray's New Token Authentication is Disabled By Default | ≤ 2.52.0 | Undetermined |
| PYSEC-2026-519 Ray OS Command Injection vulnerability | < 2.8.1 | Undetermined |
| PYSEC-2026-520 Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack | < 2.52.0 | Undetermined |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-xg2h-7cxj-3gvh Withdrawn Advisory: Command injection in Ray · withdrawn
Sources
| Source | Licence |
|---|