VDB
CVE-2026-57516
CVE-2026-57516
PUBLISHED
CVSS 8.600000381469727 HIGH
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
EPSS 0.86% · 58.4th percentile
Risk Scores
CVSS 4.0
8.600000381469727
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.86%
58.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | ray | 0 |
| Anyscale, Inc | Ray | 0 |
| chainguard | lmcache-cuda-12.8 | 0 |
| anyscale | ray | 0 |
Timeline
- Jul 1, 2026 CVE Published
- Jul 2, 2026 EPSS Score
- Jul 2, 2026 Coalition ESS Score
- Jul 14, 2026 CVE Updated
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 EPSS Score
- Aug 28, 2026 EPSS Score
- Aug 29, 2026 Security Advisory
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 5, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-57516 advisory
- https://github.com/advisories/GHSA-hhrp-gw25-jr43 advisory
- https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43 url
- https://github.com/ray-project/ray/pull/63469 patch
- https://github.com/ray-project/ray/pull/63470 patch
- https://github.com/ray-project/ray/commit/41443a18f9e6403a072de69098a279c23e2d943c patch
- https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-2273.yaml advisory
- https://github.com/ray-project/ray/releases/tag/ray-2.56.0 url
- https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader url