ray
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- PyPI
- État de vulnérabilité
- 22 avis sans verdict
Avis (22)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-3pww-qvr8-6mhp Ray Path Traversal vulnerability | < 2.8.1 | Indéterminé |
| GHSA-6cxr-8q3m-jwrr Ray Missing Authorization vulnerability | < 2.8.1 | Indéterminé |
| GHSA-6wgj-66m2-xxp2 Ray has arbitrary code execution via jobs submission API | ≤ 2.49.2 | Indéterminé |
| GHSA-gx77-xgc2-4888 Ray's New Token Authentication is Disabled By Default | ≤ 2.52.0 | Indéterminé |
| GHSA-h3xg-wv58-5p43 Ray OS Command Injection vulnerability | < 2.8.1 | Indéterminé |
| GHSA-hhrp-gw25-jr43 Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False) | < 2.56.0 | Indéterminé |
| GHSA-j3mh-qmjj-xp83 Ray Dashboard is vulnerable to path traversal through its static file handling mechanism | < 2.8.1 | Indéterminé |
| GHSA-mw35-8rx3-xf9r Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization | 2.49.0 – < 2.55.0 | Indéterminé |
| GHSA-q279-jhrf-cc6v Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack | < 2.52.0 | Indéterminé |
| GHSA-q5fh-2hc8-f6rq Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) | < 2.54.0 | Indéterminé |
| GHSA-w4rh-fgx7-q63m ray vulnerable to Insertion of Sensitive Information into Log File | < 2.43.0 | Indéterminé |
| PYSEC-2025-23 Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the sta | < 64a2e4010522d60b90c389634f24df77b603d85d ; < 2.43.0 | Indéterminé |
| PYSEC-2026-130 A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization o | < 2.8.1 | Indéterminé |
| PYSEC-2026-2271 Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE end | < 2.54.0 | Indéterminé |
| PYSEC-2026-2272 Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arro | ≤ 2.54.0 | Indéterminé |
| PYSEC-2026-2273 Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplyin | < 2.56.0 | Indéterminé |
| PYSEC-2026-515 Ray Path Traversal vulnerability | < 2.8.1 | Indéterminé |
| PYSEC-2026-516 Ray Missing Authorization vulnerability | < 2.8.1 | Indéterminé |
| PYSEC-2026-517 Ray has arbitrary code execution via jobs submission API | ≤ 2.49.2 | Indéterminé |
| PYSEC-2026-518 Ray's New Token Authentication is Disabled By Default | ≤ 2.52.0 | Indéterminé |
| PYSEC-2026-519 Ray OS Command Injection vulnerability | < 2.8.1 | Indéterminé |
| PYSEC-2026-520 Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack | < 2.52.0 | Indéterminé |
Avis retirés (1)
Retirés par leur éditeur : ils ne concernent aucune version et ne sont pas comptés ci-dessus.
- GHSA-xg2h-7cxj-3gvh Withdrawn Advisory: Command injection in Ray · retiré le
Sources
| Source | Licence |
|---|