CVE-2023-6019: Ray OS Command Injection Vulnerability
Summary
CVE-2023-6019: Ray OS Command Injection vulnerability. Affects ray versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is an open-source framework that simplifies the development of distributed applications. It provides a flexible and efficient way to scale Python applications across multiple nodes. Ray's dashboard offers insights into the performance and resource utilization of applications. However, a security flaw has been identified that allows unauthorized command execution via a specific URL parameter.
Vulnerability Detail
A command injection vulnerability exists in the cpu_profile URL parameter of Ray's dashboard. This flaw allows attackers to execute arbitrary operating system commands on the server running the Ray dashboard without requiring authentication. The vulnerability arises from improper validation of user input, which can lead to severe consequences, including unauthorized access to sensitive data and control over the server environment.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "ray==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Ray dashboard by implementing network-level controls, such as firewalls or VPNs, to limit exposure to trusted users only.
Conclusion
The Ray OS command injection vulnerability (CVE-2023-6019) poses a significant risk to applications utilizing the framework. It is crucial to update to the patched version 2.8.1 to mitigate this risk. Additionally, implementing network-level access controls can serve as a temporary workaround while the update is performed.
See every vulnerability recorded for ray →
FAQ
CVE-2023-6019 is a vulnerability in the Ray framework that allows for OS command injection through the cpu_profile URL parameter.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The vulnerability can lead to unauthorized command execution on the server, potentially compromising sensitive data and system integrity.
Yes, the vulnerability has been patched in Ray version 2.8.1. It is recommended to upgrade to this version or later.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
