CVE-2025-62593
Ray-Project Ray Code Injection Vulnerability
Description
CVE-2025-62593 is a critical remote code execution (code injection) vulnerability in Ray, the open-source AI compute engine, affecting all versions prior to 2.52.0. The flaw exists because Ray's defense against browser-based attacks relies only on checking that the User-Agent header starts with "Mozilla" — a guard that the fetch specification allows attackers to modify — leaving Ray exposed when combined with a DNS rebinding attack. A developer running Ray locally who merely visits a malicious website or is served a malicious advertisement (malvertising) can be exploited, allowing an attacker to execute arbitrary code on the developer's machine. Because Ray is widely used as a development tool for AI workloads and this vulnerability is now listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2025-62593 should be patched without delay by upgrading to Ray 2.52.0.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| anyscale | ray | < 2.52.0 |
References
- https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09(Patch)
- https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v(Exploit, Patch, Vendor Advisory)
- https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection targets the programming language interpreter itself, letting an attacker execute arbitrary code within the application's context. In CVE-2025-62593, the weak browser-attack guard in Ray allows a remote attacker to reach code-execution functionality and run arbitrary code on the developer's machine.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
CWE-352: Cross-Site Request Forgery (CSRF)
CSRF abuses the trust an application places in a user's browser, causing authenticated or local requests to be forged from a malicious page. Here, Ray's insufficient defense against cross-site and browser-based requests — bypassable by modifying the User-Agent header and pairing it with DNS rebinding — enables the attack when a developer visits attacker-controlled content.
Learn more: CWE-352 — Cross-Site Request Forgery (CSRF)
Impact Analysis
CVE-2025-62593 is rated High with a CVSS score of 8.8. The attack vector is network-based, so the vulnerability is remotely exploitable without physical access, and the attack complexity is low, meaning no special conditions are required beyond the attack setup. No privileges are required, but user interaction is required: the targeted developer must visit a malicious website or be served a malicious advertisement for the attack to succeed. Once triggered, the impact is severe across all three dimensions — high confidentiality, integrity, and availability impact — because arbitrary code execution lets an attacker read sensitive data, modify files and workloads, and disrupt the developer's environment. Although the EPSS score is around 1% (60th percentile), the inclusion of CVE-2025-62593 in the CISA KEV catalog confirms real-world exploitation and elevates its practical risk well above what the EPSS figure alone would suggest.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-62593 by adding it to the Known Exploited Vulnerabilities catalog, so this should be treated as an in-the-wild threat. Public exploit information is available for CVE-2025-62593 via the vendor's GitHub Security Advisory GHSA-q279-jhrf-cc6v, which is tagged as containing exploit details alongside the patch. The EPSS score of roughly 1% (60th percentile) suggests exploitation is possible but not yet broadly widespread; however, given the KEV listing and the low barrier to triggering the flaw through malvertising, defenders should act now. The KEV ransomware flag is currently "Unknown."
Remediation
- Upgrade Ray to version 2.52.0 or later, which contains the fix for CVE-2025-62593. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable.
- Do not expose the Ray dashboard or development services to untrusted networks. Bind Ray services to localhost or trusted interfaces only and place them behind network controls so browser-based and cross-site requests cannot reach them.
- Mitigate DNS rebinding and CSRF exposure by ensuring Ray endpoints validate the Origin/Host of incoming requests rather than relying on the User-Agent header, and by using host allowlisting where possible.
- Practice safe browsing on machines running Ray, using ad-blocking and avoiding untrusted sites while a Ray instance is active, to reduce the malvertising and malicious-website attack surface.
- Monitor developer hosts for indicators of compromise, reviewing process and network logs for unexpected code execution or outbound connections following Ray usage.
Technical Details
CVE-2025-62593 combines code injection (CWE-94) with a cross-site request forgery weakness (CWE-352). Ray attempted to guard against browser-driven attacks by requiring the User-Agent header to begin with the string "Mozilla," but the fetch specification permits scripts to modify this header, so the check provides no real protection. An attacker chains this with a DNS rebinding attack against the victim's browser, which lets a malicious web page make requests to the developer's locally running Ray instance as though they were same-origin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the attack is network-reachable and low-complexity but requires the developer to interact by visiting attacker-controlled content; once that occurs, the request reaches Ray's code-execution path and results in arbitrary code execution on the developer's system.
Frequently Asked Questions
Is CVE-2025-62593 being actively exploited?
Yes. CVE-2025-62593 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit details are also available through the vendor's GitHub Security Advisory, and while its EPSS score is around 1%, the KEV listing means it warrants immediate attention.
What products are affected by CVE-2025-62593?
The vulnerability affects Ray, the open-source AI compute engine (Anyscale / ray-project), in all versions prior to 2.52.0. Developers running Ray as a local development tool are the primary targets.
How do I fix CVE-2025-62593?
Upgrade Ray to version 2.52.0 or later, which patches the vulnerability. Additionally, avoid exposing Ray services to untrusted networks, ensure endpoints validate request origin rather than the User-Agent header, and practice safe browsing on hosts running Ray.
How severe is CVE-2025-62593?
It is rated High with a CVSS 3.1 score of 8.8. Exploitation requires user interaction (visiting a malicious site) but no authentication, and results in high impact to confidentiality, integrity, and availability through arbitrary code execution. Its presence in the KEV catalog raises its real-world severity despite an EPSS score around the 60th percentile.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.