Read the docs

Ray-Project

Records7All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Ray-Project records in CISA KEV
TI-2025-38808 Ray-Project Ray Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-17

Components

Products in the NVD configurations · select one to filter the records
Ray 3 records HIGH

Records

3 records in Ray · all components

TI-2023-05545 CVE-2023-6019 · GHSA-h3xg-wv58-5p43

Ray Command Injection in cpu_profile Parameter

Priority HIGH 81

A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7463 Published 2023-11-16 Fixed in 2.8.1 CWE-78
TI-2023-05547 CVE-2023-6021 · GHSA-3pww-qvr8-6mhp

Ray Log File Local File Include

Priority HIGH 72

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.37076 Published 2023-11-16 Fixed in 2.8.1 CWE-29
TI-2023-05546 CVE-2023-6020 · GHSA-6cxr-8q3m-jwrr

Ray Static File Local File Include

Priority MEDIUM 48

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.14652 Published 2023-11-16 Fixed in 2.8.1 CWE-862
Open these records in search →