← Back to CVE List
Vulnerability Analysis
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

CVE-2025-62593

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

CISA KEV SSVC: Active Exploitation Cross-Site Request Forgery (CSRF)
CVSS Base Score
9.4
CRITICAL
Exploitability:-
Impact Score:-
Temporal Score:-
EPSS:0.37%

Threat Intelligence Signals

CISA KEV
YES
KEV Date Added
2026-08-18
Ransomware Use
Unknown
KEV Due Date
2026-08-21
VulnCheck In-the-Wild
No
Nuclei Template
No
EPSS Score
0.369%
EPSS Percentile
29.9th pct
GitHub Severity
CRITICAL
SSVC Exploitation
Active
SSVC Automatable
No
Vulnerability Class
Cross-Site Request Forgery (CSRF)

Identity & Timeline

Status-
Assigning Authority-
CVSS Version / Source-
Reserved-
Published-
Patch Date (date_public)-
Exploit DB Date-
First GitHub PoC Date-
Last Updated-
Time to Patch (Days to fix)-
Exploit Release Gap-
PoC Release Gap-
Exploit DB ReferencesNone identified

Affected Products & Versions

Vendor Product Affected Versions
No affected products specified.

References

No reference links found.

LINK COPIED TO CLIPBOARD