CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
CISA flags critical Ray flaw, citing active exploitation. CVE-2025-62593 can lead to remote code execution via web browsers like Firefox and Safari.
Intelligence analysis by Qwen 2.5 (3B)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in the open-source Ray framework to its Known Exploited Vulnerabilities list, citing evidence of active exploitation by threat actors.
A flaw in a software called Ray can let bad guys trick people into visiting fake websites or ads that run code on their computers, which could steal money or cause problems.
Analysis
{"#insufficient-controls":"The core issue stems from insufficient controls against browser-based attacks. Specifically, the User-Agent header can be modified, enabling a DNS rebinding attack that allows attackers to exploit developers running Ray in development environments.","#dns-rebinding-attack":"A DNS rebinding attack is used to trick users into visiting malicious websites or ads, which then execute arbitrary shell code on their machines. This attack leverages the browser as a confused deputy intermediary to target instances of Ray within corporate networks.","#mitigation-and-exploitation":"The vulnerability was addressed in version 2.52.0 of the Python package. However, unpatched Ray instances have been used by threat actors for cryptocurrency mining and DDoS attacks. CISA recommends agencies apply necessary fixes and mitigations by August 20, 2026."}
Key points
- CISA flags a critical flaw in the open-source Ray framework
- The flaw can lead to remote code execution via web browsers like Firefox and Safari
- Fixing this issue will make it harder for attackers to use the flaw
- Developers need to keep their software updated to protect against such attacks
Fixing this issue will make it harder for attackers to use the flaw and reduce the risk of attacks like DDoS and cryptocurrency mining.
If unpatched Ray instances are used by threat actors, they could still exploit the vulnerability. Developers need to keep their software updated to protect against such attacks.
