{"action":"Upgrade ray to 2.52.0 or later.","affected":[{"fixed":"2.52.0","introduced":"0"}],"component":"ray","cve_ids":["CVE-2025-62593"],"ecosystem":"PyPI","epss":0.6015,"exploited":true,"fixed_versions":["2.52.0"],"ghsa_id":"GHSA-q279-jhrf-cc6v","id":"tcs_01M5KFV180PCS7SRXNNA25KZCE","modified_at":"2026-09-10T03:50:58.426794053Z","published_at":"2025-11-26T19:35:23Z","references":["https://osv.dev/vulnerability/GHSA-q279-jhrf-cc6v","https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","https://nvd.nist.gov/vuln/detail/CVE-2025-62593","https://github.com/nccgroup/singularity/pull/68","https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09","https://docs.ray.io/en/releases-2.51.1/ray-security/index.html","https://en.wikipedia.org/wiki/Malvertising","https://github.com/ray-project/ray","https://github.com/ray-project/ray/blob/e7889ae542bf0188610bc8b06d274cbf53790cbd/python/ray/dashboard/http_server_head.py#L184-L196","https://github.com/ray-project/ray/blob/f39a860436dca3ed5b9dfae84bd867ac10c84dc6/python/ray/dashboard/optional_utils.py#L129-L155"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-q279-jhrf-cc6v","url":"https://osv.dev/vulnerability/GHSA-q279-jhrf-cc6v"},{"source":"kev","source_id":"CVE-2025-62593","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"source":"nvd","source_id":"CVE-2025-62593","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62593"}],"summary":"Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack"}