{"action":"Upgrade ray to 2.56.0 or later.","affected":[{"fixed":"2.56.0","introduced":"0"}],"component":"ray","cve_ids":["CVE-2026-57516"],"ecosystem":"PyPI","epss":0.00858,"exploited":false,"fixed_versions":["2.56.0"],"ghsa_id":"GHSA-hhrp-gw25-jr43","id":"tcs_01M5KFKRSPK89SNZFJNRCN22FK","modified_at":"2026-09-10T03:50:52.427940507Z","published_at":"2026-07-24T15:47:38Z","references":["https://osv.dev/vulnerability/GHSA-hhrp-gw25-jr43","https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43","https://nvd.nist.gov/vuln/detail/CVE-2026-57516","https://github.com/ray-project/ray/pull/63469","https://github.com/ray-project/ray/pull/63470","https://github.com/ray-project/ray/commit/41443a18f9e6403a072de69098a279c23e2d943c","https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-2273.yaml","https://github.com/ray-project/ray","https://github.com/ray-project/ray/releases/tag/ray-2.56.0","https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-hhrp-gw25-jr43","url":"https://osv.dev/vulnerability/GHSA-hhrp-gw25-jr43"}],"summary":"Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)"}