7 CVEs affect the Ray PyPI package (highest CVSS 9.8). 1 on CISA's Known Exploited Vulnerabilities catalog. Latest disclosed: 2026-07-01. Full CVE history sourced from NVD.
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function.
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function.