CVE-2025-62593
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-11-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ray | ray | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Ray, an AI compute engine, prior to version 2.52.0. It is a critical remote code execution (RCE) vulnerability that can be exploited via Firefox and Safari browsers. The issue arises because Ray's defense mechanism relies on the User-Agent header starting with "Mozilla" to block attacks, but this is insufficient since the fetch specification allows modification of the User-Agent header. When combined with a DNS rebinding attack, a developer running Ray who visits a malicious website or is served a malicious advertisement can have their system exploited remotely. The vulnerability has been fixed in version 2.52.0.
How can this vulnerability impact me? :
This vulnerability can lead to critical remote code execution on a developer's system running Ray if they visit a malicious website or encounter malvertising. This means an attacker could execute arbitrary code remotely, potentially compromising the developer's system, stealing data, or causing other malicious effects.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Ray to version 2.52.0 or later, as this version contains the patch for the critical RCE vulnerability. Additionally, avoid visiting untrusted websites or interacting with potentially malicious advertisements while using Ray as a development tool.