{"action":"Upgrade ray to 2.56.0 or later.","affected":[{"fixed":"2.56.0","introduced":"0"}],"component":"ray","cve_ids":["CVE-2026-57516"],"ecosystem":"PyPI","epss":0.00858,"exploited":false,"fixed_versions":["2.56.0"],"ghsa_id":"GHSA-hhrp-gw25-jr43","id":"tcs_01M5KGYFVQQCP5ZXEHYWS5ZG4P","modified_at":"2026-07-13T07:15:44.097966037Z","published_at":"2026-07-01T17:16:37.390Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2273","https://github.com/ray-project/ray/releases/tag/ray-2.56.0","https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader","https://github.com/ray-project/ray/pull/63469","https://github.com/ray-project/ray/pull/63470","https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-2273","url":"https://osv.dev/vulnerability/PYSEC-2026-2273"}],"summary":"Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_we"}