PyPI/ray CVE-2026-41486: high 8.8, EPSS 0.47%

Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

Action: Upgrade ray to 2.55.0 or later.

pip install ray==2.55.0

Affected

Fixed versions

Sources

• osv: GHSA-mw35-8rx3-xf9r
• nvd: CVE-2026-41486
• https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r
• https://github.com/ray-project/ray/pull/54831
• https://github.com/ray-project/ray/pull/62056
• https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f
• https://github.com/ray-project/ray
• https://github.com/ray-project/ray/releases/tag/ray-2.55.0

CVE-2026-41486 · published 2026-04-24T16:15:00Z · modified 2026-09-10T03:51:02.380215690Z · JSON