CVE-2025-62593, a critical bug in the Ray framework scored 9.4 under CVSS v4, can allow remote code execution simply by a developer visiting a malicious web page or being served a hostile ad in Firefox or Safari.
How the vulnerability operates
The security bulletin describes a chain that begins with Ray instances attempting to identify and block browser requests by checking whether the User-Agent header begins with "Mozilla." Firefox and Safari, however, permit scripts using the Fetch API to change that header. A developer running Ray who visits a compromised site or loads a malicious advertisement can thus let an attacker craft requests that appear browser-originated.
Once the browser is induced to send such traffic, the attacker can use DNS rebinding to make the browser reach the local Ray service. The project's developers warned: "This vulnerability impacts developers running development/testing environments with Ray," and added that "If they fall victim to a phishing attack, or are served a malicious ad, they can be exploited, and arbitrary shell code can be executed on their developer machine." The advisory also notes the attack can be used to target network-adjacent Ray instances by “leveraging the browser as a confused deputy intermediary to attack Ray instances running inside a private corporate network.”
CISA's three-day remediation order and the agency's rationale
The Cybersecurity and Infrastructure Security Agency gave US federal civilian executive branch agencies three days to remediate the flaw, an abbreviated window compared with the standard 14 days. CISA did not explain the urgency in its notice and left the catalog field “known to be used in ransomware campaigns” marked as "unknown." The agency's action follows the framework in Binding Operational Directive 26-04, which allows a three-day remediation deadline for vulnerabilities the agency considers especially risky.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy Ray's architecture made exploitation feasible
The advisory attributes the exploitability in part to Ray's longstanding lack of authentication on critical endpoints. Ray’s security model historically assumed clusters would run inside a trusted, isolated network and therefore left authentication and access control to the surrounding infrastructure. That design assumption, the project acknowledged, made development and testing environments particularly exposed when a developer's browser can become the attacker’s intermediary.
Ray 2.52.0: fix and mitigations
Ray 2.52.0 contains the fix for CVE-2025-62593. The release also added optional token-based authentication intended to provide an additional layer of defense against unauthorized access; the advisory notes that this authentication remains disabled by default. The Ray project continues to recommend deploying clusters inside a controlled network rather than treating authentication as a substitute for isolation.
The project is managed by the Linux Foundation's PyTorch Foundation and traces its origins to UC Berkeley; it was commercialized by Anyscale in 2019. Usage figures cited by Anyscale in October 2025 put Ray at more than 237 million total downloads and about 7 million downloads per week, representing near-tenfold year-on-year growth. Product analysis site NextSprints estimates Ray has 1 million monthly active users and is used by 60 percent of Fortune 500 companies. The framework is used and supported by major technology companies, including Amazon, Apple, and OpenAI.
What this means for developers, federal agencies, and enterprises
- Developers and security teams: Expect immediate patching and scope assessments in development and test environments. The project warning centers the risk on developers who might visit hostile web content and on private networks reachable via the browser-as-intermediary attack path.
- Federal civilian executive branch agencies: Agencies were ordered to remediate within three days under CISA's use of Binding Operational Directive 26-04; those agencies face a compressed timeline and an advisory that did not publicly explain the agency's urgency or link the bug to known ransomware campaigns.
- Enterprises and procurement leaders: Organizations that run Ray in lab, staging, or production—particularly those among the 60 percent of Fortune 500 companies estimated to use Ray—will need to weigh enabling the optional token-based authentication, keeping clusters isolated, and applying the Ray 2.52.0 update.
The chain of events the advisory lays out—browser header manipulation, DNS rebinding, and unauthenticated critical endpoints—turns a widely used developer tool into a potentially effective attack vector. Ray 2.52.0 closes the technical hole, but the project’s guidance and CISA’s compressed remediation window underscore a broader configuration and deployment question: how organizations balance network isolation, default settings, and optional authentication in software that moves workloads from local machines to cluster environments. CISA's lack of public explanation for the three-day deadline and the "unknown" ransomware field leave an open, practical question for defenders: how often will such abbreviated timelines be imposed, and how prepared are environments that rely on default, permissive settings?
