Ray browser-triggered code execution flaw CVE-2025-62593 exploited; fixed in 2.52.0
A malicious page or advert viewed in Firefox or Safari can trigger code execution through vulnerable Ray development systems. CISA confirms exploitation. Developers and IT teams should update Ray to 2.52.0 or later.
If you or your business uses Ray, ask the developer or IT team to update it to 2.52.0 or later. Families who do not run Ray have no direct update to install for this flaw.
What’s happening
Ray, software used for AI and distributed computing, has a browser-triggered code execution flaw affecting versions before 2.52.0. A developer visiting a malicious page or receiving a malicious advert in Firefox or Safari could expose their development computer or another Ray instance reachable inside a private network. Ray disclosed the flaw in November 2025 and identifies 2.52.0 as the fix. Bitsight documented RondoDox attempts beginning on 24 November 2025, but found those particular attempts ineffective. Separately, CISA confirmed exploitation by adding the flaw to its catalogue on 17 August 2026. The reviewed sources do not identify confirmed victims or losses. As at 3 November, a released fix remains available; ransomware use is unknown.
- What
- Flaw
- Affects
- Ray AI and distributed computing framework
- Affected
- Ray (pip package ray) versions before 2.52.0
- Fixed in
- Ray 2.52.0
- Since
- 17 Aug 2026
- Closed
- 17 Aug 2026
Timeline
- CISA added
CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalogue, with a federal remediation deadline of 20 August. Whether it was used in ransomware campaigns was marked unknown.
- Update
Bitsight published its RondoDox investigation, documenting the November attempts while explaining that they would not successfully exploit this flaw.
- Made publicFixed
Ray published its advisory, identifying versions before 2.52.0 as affected and the already released 2.52.0 as fixed.
- Update
Bitsight first observed RondoDox attempts targeting CVE-2025-62593 on this date. Its later analysis found those attempts were incorrectly implemented and ineffective.
Sources
- Critical RCE Vulnerability against Ray Devs exploitable via Browser (Safari & Firefox) due to DNS Rebinding AttackRay Project · 26 Nov 2025
- Ray-2.52.0 releaseRay Project · 21 Nov 2025
- RondoDox Botnet: From Zero to 174 Exploited VulnerabilitiesBitsight · 11 Mar 2026
- Known Exploited Vulnerabilities catalogue, 3 November 2026 snapshotCISA · 3 Nov 2026
- CISA gives feds 3 days to fix actively exploited Ray RCE bugThe Register · 18 Aug 2026