{"schema":"threatline.record/2","record":{"id":"CVE-2025-62593","aliases":["GHSA-q279-jhrf-cc6v","PYSEC-2026-520"],"summary":"Ray-Project Ray Code Injection Vulnerability","details":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.","categories":["Libraries & packages"],"product":"Ray","vendor":"Ray-Project","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-62593","source_modified_at":"2026-10-01T18:07:54.129Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"ray","vendor":"ray-project","versions":[{"status":"affected","version":"< 2.52.0"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-q279-jhrf-cc6v","source_modified_at":"2026-09-10T03:50:58.426794053Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"PyPI","name":"ray","purl":"pkg:pypi/ray"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.52.0"}],"type":"ECOSYSTEM"}],"versions":["0.1.1","0.1.2","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.5.0","0.5.2","0.5.3","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","1.0.0","1.0.1","1.1.0","1.10.0","1.11.0","1.11.1","1.12.0","1.12.1","1.13.0","1.2.0","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-q279-jhrf-cc6v","source_modified_at":"2026-09-10T03:50:58.426794053Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"PyPI","name":"ray","purl":"pkg:pypi/ray"},"version":"2.52.0"}],"cvss":9.4,"severity":"Critical","kev":{"listed":true,"date_added":"2026-08-17","due_date":"2026-08-20","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware_campaign_use":"Unknown","forensic_triage":true},"epss":{"probability":0.62459,"percentile":0.99189,"score_date":"2026-10-23"},"published_at":"2025-11-26T22:28:28.577Z","modified_at":"2026-10-01T18:07:54.129Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-62593","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T18:07:54.129Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-q279-jhrf-cc6v","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-10T03:50:58.426794053Z"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62593.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-62593","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","OSV","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09","tags":["x_refsource_MISC"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62593","source":"CISA KEV"},{"source":"CVE List","url":"https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2026-08-18T03:55:34.674806Z"},"exploits":[{"kind":"Scanner template","name":"Ray < 2.52.0 - Remote Code Execution","source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62593.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T18:07:54.129Z","content_hash":"7d9d9901ecd136e1c24f327ccb994203a9099cd06debfd41cd07c7f7530428c5"}}