CVE-2025-62593: Cross-Site Code Injection Risk in Ray AI Framework

Developers running the Ray unified AI compute framework locally may be unknowingly exposed to arbitrary code execution through browser-based cross-site requests. The Ray-Project Ray Code Injection Vulnerability (CVE-2025-62593) combines code injection (CWE-94) and cross-site request forgery (CWE-352) to allow malicious web pages visited by developers to execute arbitrary Python code on local Ray instances.

Understanding the Cross-Origin Attack Path

Ray nodes frequently run an internal management dashboard and API server (by default on port 8265). These services allow users to submit computational jobs, inspect worker nodes, and execute code across the distributed cluster. When authentication or origin validation is missing or insufficient, any network context that can craft requests to the endpoint can interact with the framework.

In an attack scenario leveraging CVE-2025-62593, a developer hosting a local Ray cluster visits a compromised or attacker-controlled website. That page uses cross-site request forgery (CSRF) to send HTTP POST requests directly to localhost or local network IP addresses where the Ray API endpoints are listening. Because the vulnerable endpoints accept cross-site input without requiring CSRF tokens or enforcing strict origin validation, the request triggers a code injection flaw that executes arbitrary code inside the Ray worker environment.

Why Browser Differences Matter Here

The primary exposure vector highlights a critical difference in how modern web browsers enforce local network security. Chromium-based browsers employ Private Network Access (PNA) rules that block public websites from issuing cross-origin requests to private IP addresses or localhost unless explicitly permitted.

In contrast, browsers like Firefox and Safari handle local cross-origin fetches under standard Cross-Origin Resource Sharing (CORS) rules. If a developer visits a malicious website using Firefox or Safari while running a vulnerable Ray instance on their system, the site can successfully send payload-bearing requests to http://127.0.0.1:8265 without browser-level blocking. Once delivered, the request triggers the underlying code injection flaw with the full system permissions of the running Ray process.

Assessing Real-World Risk

With an EPSS score of 0.37% (putting it in the 29.9th percentile), automated internet-wide exploitation remains low. However, standard risk metrics frequently underestimate local browser-assisted vectors because these attacks rely on drive-by downloads or watering-hole pages rather than internet-scannable open ports.

Machine learning engineering environments are prime targets for initial access campaigns. Developer workstations routinely host sensitive cloud credential files, source code repositories, and SSH keys for cluster infrastructure. A successful cross-site compromise of a local Ray instance gives an attacker an immediate foothold inside enterprise development environments.

Mitigation and Enforcement

To resolve CVE-2025-62593, security teams must ensure developers and cluster administrators update Ray and enforce network isolation:

• Apply Vendor Updates: Upgrade Ray installations to the latest fixed release from Ray-Project, which introduces origin checks and anti-CSRF protections on local dashboard and job endpoints.
• Restrict Listening Interfaces: Configure Ray instances to bind dashboard interfaces strictly to loopback addresses or isolated container networks when remote cluster management is not required.
• Enforce Authentication: Enable explicit token-based authentication on the Ray dashboard and submission endpoints if access across local network segments is necessary.
• Adhere to Remediation Deadlines: Organizations subject to federal cyber governance must apply vendor-recommended mitigations prior to the August 21, 2026 deadline in accordance with BOD 26-04 guidelines.