AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

RayGHSA-h3xg-wv58-5p43

Ray OS Command Injection vulnerability

Ray

CVE-2023-6019 · Published Nov 16, 2023 · updated Sep 10, 2026

Critical9.8
Fix: upgrade to 2.8.1 or later
GitHub advisory

A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

Affected versions

PackageAffectedFixed in
ray
PyPI
< 2.8.12.8.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-78
Also known as
CVE-2023-6019, PYSEC-2026-519

More Ray advisories

All Ray
CriticalNov 27, 2025Ray's New Token Authentication is Disabled By DefaultCVE-2025-34351no fix yetCriticalNov 26, 2025Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding AttackCVE-2025-62593fixed in 2.52.0Medium 6.4Mar 6, 2025ray vulnerable to Insertion of Sensitive Information into Log FileCVE-2025-1979fixed in 2.43.0Critical 9.8Nov 28, 2023Ray has arbitrary code execution via jobs submission APICVE-2023-48022no fix yetCritical 9.3Nov 16, 2023Ray Missing Authorization vulnerabilityCVE-2023-6020fixed in 2.8.1Critical 9.3Nov 16, 2023Ray Path Traversal vulnerabilityCVE-2023-6021fixed in 2.8.1