CVE-2026-57516: Ray Package Arbitrary Code Execution via Unsafe Deserialization
Summary
CVE-2026-57516: ray.data.read_webdataset(paths=...) is a @PublicAPI(stability="alpha") reader for WebDataset-format TAR files. Affects ray versions < 2.56.0. Fixed in 2.56.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a simple interface for parallel and distributed computing, enabling users to scale their applications effortlessly. However, Ray has a vulnerability in its data loading mechanism, specifically in the ray.data.read_webdataset function, which can lead to arbitrary code execution when processing untrusted WebDataset TAR files.
Vulnerability Detail
The vulnerability arises from the default behavior of the ray.data.read_webdataset function, which deserializes data from TAR files without adequate validation. Attackers can exploit this by supplying malicious TAR files containing .pickle or .pt files, leading to arbitrary code execution in the Ray process. This issue is particularly concerning as it allows attackers to execute arbitrary commands on the host system, posing significant security risks.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.56.0
This is the first release that contains the fix.
pip install --upgrade "ray==2.56.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the default decoder by explicitly setting the decoder parameter to None when calling ray.data.read_webdataset. This will prevent the automatic deserialization of potentially unsafe file types. Example code: ds = ray.data.read_webdataset(paths=[tar_path], decoder=None).
Conclusion
The CVE-2026-57516 vulnerability in the Ray package poses a significant risk due to its potential for arbitrary code execution through unsafe deserialization of untrusted TAR files. Users are advised to update to version 2.56.0 or later to mitigate this risk and to consider implementing custom decoders for added security.
See every vulnerability recorded for ray →
FAQ
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability involves .pickle, .pkl, .pt, and .pth files that can be deserialized without proper validation.
Exploitation of this vulnerability can lead to arbitrary code execution, allowing attackers to run malicious commands on the host system.
Yes, you can mitigate the risk by setting the decoder parameter to None when using ray.data.read_webdataset, which prevents automatic deserialization.
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
