{"action":"Upgrade ray to 2.52.0 or later.","affected":[{"fixed":"2.52.0","introduced":"0"}],"component":"ray","cve_ids":["CVE-2025-62593"],"ecosystem":"PyPI","epss":0.6015,"exploited":true,"fixed_versions":["2.52.0"],"ghsa_id":"GHSA-q279-jhrf-cc6v","id":"tcs_01M5KHBWHVA2ZW3Z0G3236A07D","modified_at":"2026-07-01T20:23:03.643178Z","published_at":"2026-06-29T11:50:36.664292Z","references":["https://osv.dev/vulnerability/PYSEC-2026-520","https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","https://nvd.nist.gov/vuln/detail/CVE-2025-62593","https://github.com/nccgroup/singularity/pull/68","https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09","https://docs.ray.io/en/releases-2.51.1/ray-security/index.html","https://en.wikipedia.org/wiki/Malvertising","https://github.com/ray-project/ray","https://github.com/ray-project/ray/blob/e7889ae542bf0188610bc8b06d274cbf53790cbd/python/ray/dashboard/http_server_head.py#L184-L196","https://github.com/ray-project/ray/blob/f39a860436dca3ed5b9dfae84bd867ac10c84dc6/python/ray/dashboard/optional_utils.py#L129-L155","https://pypi.org/project/ray","https://github.com/advisories/GHSA-q279-jhrf-cc6v"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-520","url":"https://osv.dev/vulnerability/PYSEC-2026-520"},{"source":"kev","source_id":"CVE-2025-62593","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"source":"nvd","source_id":"CVE-2025-62593","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62593"}],"summary":"Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack"}