Vulnerability · Published Nov 16, 2023 · Assigned by @huntr_ai
CVE-2023-6019Ray Command Injection in cpu_profile Parameter
Critical 9.8
In plain English
A critical-severity OS command injection in ray-project/ray from ray-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 74.6% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | ray | 2.8.1 | GHSA-h3xg-wv58-5p43 |
| PyPI | ray | 2.8.1 | PYSEC-2026-519 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ray-project | ray-project/ray | unspecified – through latest |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H