Anyscale Ray 2.54.0
Approved changes feed: RSS · Atom
cpe:2.3:a:anyscale:ray:2.54.0:*:*:*:*:*:*:*
part: a version: 2.54.0 update: *
| Vendor | Anyscale (4bbc75f4-b81a-5fff-bf2e-9c36af8035bd) |
|---|---|
| Product | Ray (69596963-194f-5879-b6e8-09fdd3139eb9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41486 |
vulnerable | 2026-06-08 08:03:15.473527 |
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.
Published: 2026-05-08T21:46:14.442Z
Updated: 2026-05-12T02:07:57.661Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.