Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ray's development server can be compromised when a developer visits a malicious website, due to weak browser security checks. An attacker uses DNS tricks and fake browser headers to run harmful code on the developer's machine.
CVE-2025-62593 exploits insufficient CSRF protection in Ray's web interface by bypassing User-Agent validation through header spoofing combined with DNS rebinding attacks. The attack vector targets developers running Ray locally who visit attacker-controlled sites; successful exploitation allows arbitrary code execution with the privileges of the developer's session. Affected versions prior to 2.52.0 lack proper SameSite cookie enforcement and origin validation.