SB20261109206 - Deserialization of Untrusted Data in Ray

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109206

SB20261109206 - Deserialization of Untrusted Data in Ray

Published: November 9, 2026

Security Bulletin ID SB20261109206
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-57516)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the calling Ray process.

The vulnerability exists due to unsafe deserialization of pickle and PyTorch objects by the default decoder in ray.data.read_webdataset when reading WebDataset TAR archives. An unauthenticated remote attacker can supply a crafted archive and persuade a victim to load it through this API, causing code execution during schema sampling before row data is consumed.


Remediation

Install update from vendor's website.

References