CVE-2023-6019: Ray OS Command Injection vulnerability
Summary
CVE-2023-6019: Ray OS Command Injection vulnerability. Affects ray versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is a Python library for distributed computing that provides a simple and efficient way to parallelize Python code. It allows users to scale their applications from a single machine to a cluster of machines. The Ray dashboard is a web-based interface that provides monitoring and debugging capabilities for Ray applications. This vulnerability affects versions of Ray up to and including 2.6.3.
Vulnerability Detail
The Ray dashboard's cpu_profile URL parameter is vulnerable to command injection. This means that an attacker can execute arbitrary operating system commands on the system running the Ray dashboard without authentication. By exploiting this vulnerability, an attacker can gain unauthorized access to the system, potentially leading to further compromise or unauthorized actions.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "ray==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of Ray as soon as possible.
Conclusion
The Ray OS Command Injection vulnerability (CVE-2023-6019) allows attackers to execute arbitrary operating system commands on the system running the Ray dashboard. To mitigate the risk, it is crucial to update to the patched version of Ray (2.6.4). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ray →
FAQ
Ray is a Python library for distributed computing that allows users to parallelize their Python code and scale their applications across multiple machines.
The Ray dashboard is a web-based interface that provides monitoring and debugging capabilities for Ray applications.
Command injection is a vulnerability that allows an attacker to execute arbitrary operating system commands on a target system.
This vulnerability allows an attacker to execute arbitrary commands on the system running the Ray dashboard, potentially leading to unauthorized access and further compromise.
To mitigate the risk of this vulnerability, it is recommended to update your Ray installation to the latest patched version (2.6.4).
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
