Ray's CVSS 9.4 Flaw Is Confirmed Under Active Exploitation: Visiting One Malicious Page While Running Ray Can Execute Code

CISA added Ray's CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, giving federal agencies until August 20 to upgrade or stop running it — one of the tightest windows it issues. The flaw scores CVSS 9.4: before version 2.52.0, browser protection on the Ray dashboard and API checked only whether the HTTP User-Agent began with "Mozilla," which combined with DNS rebinding allows arbitrary code execution on a developer's machine and lets the browser pivot to network-adjacent Ray instances. Bitsight reports the RondoDox botnet began exploitation attempts on November 24, 2025.

The Defense Was One User-Agent Check

Ray is an open-source framework used widely for AI training and inference, and its dashboard and API have long treated browser-originated requests as something to block. Before 2.52.0, that decision rested on whether the HTTP User-Agent header started with "Mozilla" — a header browsers can change themselves. Pair that with DNS rebinding, and a developer merely visiting a malicious website, or loading a malicious advertisement, on a machine running Ray is enough for remote code execution. The issue is classified under CWE-94 (code injection) and also associated with CWE-352 (cross-site request forgery). The Ray maintainers' November 2025 advisory named the root cause plainly: critical endpoints such as /api/jobs and /api/job_agent/jobs/ were left without authentication as a longstanding design decision. A compromised browser can also act as a confused deputy against other Ray instances reachable inside a private corporate network — meaning one developer machine falling over exposes the whole internal cluster estate.

From Proof of Concept to Active Exploitation

On August 17, CISA changed the CVE's SSVC entry from "proof of concept" to "active" exploitation and attached a reference to Bitsight's research on the RondoDox botnet. Per Bitsight, RondoDox began attempting to exploit the flaw on November 24, 2025 — two days before the CVE was published on November 26. The issue has also been linked to attacks such as ShadowRay 2.0.

The Hard Part Is Finding Where It Is Installed

The fix itself is simple: upgrade to 2.52.0 or later; every previous version is affected. Asset inventory is the problem. Ray usually is not installed like conventional enterprise software but sits as a Python package inside AI/ML environments. The places to check include developer laptops, container images, Kubernetes clusters and cloud AI infrastructure — and missing any one of them is equivalent to not patching. There is a more general lesson attached. Basing a trust decision on a client-controlled field — User-Agent, Referer and the like — is the same as making no decision. For frameworks in this class, putting real authentication in front of the dashboard and API is a better investment than continuing to patch each bypass.

via: CISA alert, The Hacker News, Security Affairs, The Next Web