Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and…
Ray
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-57516
- Affects
- Ray
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 1, 2026
- Source last modified
- October 25, 2026
Description
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
Description quoted from the NVD record.
Who is affected
Ray, made by Anyscale, is a tool for spreading large computing jobs across many computers. This flaw affects versions of Ray before 2.56.0, in the feature that reads data stored as WebDataset archive files (bundles of many files packed together). If someone can get Ray to read an archive file they have tampered with, they can run any code they choose on each worker computer in your Ray setup that processes that file. This flaw is rated High.
What to do
- The person who installed or runs Ray for your organization, or the IT provider who manages it, should handle this flaw.
- Check which version of Ray your organization uses. Any version before
2.56.0has this flaw. - Update Ray to version
2.56.0or later on every computer in your Ray setup. This is the fix for this flaw. - If an IT provider or vendor runs Ray for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.