CISA added a critical Ray vulnerability, tracked as CVE-2025-62593, to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation.
Ray is the open-source, Python-native framework used to scale AI and machine-learning workloads from a laptop to a cluster; it is built into pipelines at Amazon, Apple and OpenAI, according to The Register. The bug carries a CVSS v4 score of 9.4 and was first disclosed in November 2025, per the NVD advisory.
How the browser becomes the attacker
Vulnerable Ray builds try to keep browsers away from the local Ray API by rejecting any request whose User-Agent header starts with “Mozilla”. Firefox and Safari both let a page’s own JavaScript rewrite that header via the Fetch API, so the check does nothing. Combined with DNS rebinding, a malicious site or a bad ad can reach a developer’s local Ray instance directly.
“This vulnerability impacts developers running development/testing environments with Ray,” the project’s maintainers said, as quoted by The Register. “If they fall victim to a phishing attack, or are served a malicious ad, they can be exploited, and arbitrary shell code can be executed on their developer machine. This attack can also be leveraged to attack network-adjacent instances of Ray by leveraging the browser as a confused deputy intermediary to attack Ray instances running inside a private corporate network.”
Ray 2.52.0 fixes the flaw.
Three days, no explanation
CISA is giving federal civilian agencies just three days to remediate, not the usual 14, under the compressed window that Binding Operational Directive 26-04 permits for vulnerabilities it treats as especially risky. The agency did not say why this one qualifies, and left the KEV catalogue’s “known to be used in ransomware campaigns” field marked unknown. That combination, a maximally tight deadline paired with a shrug on ransomware activity, is the detail worth sitting with: it reads as CISA acting on exploitation evidence it is not disclosing, rather than on a documented ransomware playbook.
What to watch
Anyone running Ray in a dev or test environment, not just federal agencies, should treat 2.52.0 as mandatory rather than optional, since the browser-based attack path means exposure is not limited to internet-facing instances. Worth watching whether CISA or Ray’s maintainers say more about what the observed exploitation has actually looked like.
Image: Tumisu / Pixabay
