CVE-2025-62593: critical vulnerability in ray-project ray
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ray's development server can be compromised when a developer visits a malicious website, due to weak browser security checks. An attacker uses DNS tricks and fake browser headers to run harmful code on the developer's machine.
CVE-2025-62593 exploits insufficient CSRF protection in Ray's web interface by bypassing User-Agent validation through header spoofing combined with DNS rebinding attacks. The attack vector targets developers running Ray locally who visit attacker-controlled sites; successful exploitation allows arbitrary code execution with the privileges of the developer's session. Affected versions prior to 2.52.0 lack proper SameSite cookie enforcement and origin validation.
In the same product, most dangerous first.