Vulnerability · Published Jul 1, 2026 · Assigned by VulnCheck

CVE-2026-57516Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader

High 8.8

In plain English

A high-severity unsafe deserialization in Ray from Anyscale, Inc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	ray	2.56.0	GHSA-hhrp-gw25-jr43
PyPI	ray	2.56.0	PYSEC-2026-2273

Affected products (as reported)

Vendor	Product	Versions
Anyscale, Inc	Ray	0 – before 2.56.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Release Notes release-notes
GitHub Security Advisory (GHSA-hhrp-gw25-jr43) vendor-advisory
Fix PR (1) patch, issue-tracking
Fix PR (2) patch, issue-tracking
https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader third-party-advisory