CVE-2025-62593

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

• CWE-94
• CWE-352

• https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09Patch
• https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6vExploit, Patch, Vendor Advisory
• https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysisThird Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593US Government Resource

Published

Nov 26, 2025

Last Modified

Aug 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62588Vulnerability in the Oracle VM VirtualBox product of Oracle …8.2
• CVE-2025-62589Vulnerability in the Oracle VM VirtualBox product of Oracle …8.2
• CVE-2025-6259The esri-map-view plugin for WordPress is vulnerable to Stor…6.4
• CVE-2025-62590Vulnerability in the Oracle VM VirtualBox product of Oracle …8.2
• CVE-2025-62591Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2025-62592Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2025-62594ImageMagick is a software suite to create, edit, compose, or…5.5
• CVE-2025-62595Koa is expressive middleware for Node.js using ES2017 async …6.1
• CVE-2025-62596Youki is a container runtime written in Rust. In versions 0.…10
• CVE-2025-62597WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-62598WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-62599eprosima Fast DDS is a C++ implementation of the DDS (Data D…7.5