Executive brief
Ray is an open-source AI compute engine used to scale machine learning workloads. A vulnerability in its data processing component allows an attacker to execute malicious code on a system by providing a specially crafted Parquet data file. This could lead to a full system compromise or unauthorized access to sensitive AI models and datasets whenever the application attempts to read the malicious file.
Technical details
Ray Data registers custom Arrow extension types (such as ray.data.arrow_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing these types, it invokes __arrow_ext_deserialize__ on the field's metadata. In affected versions, Ray's implementation of this method passes the metadata bytes directly to cloudpickle.loads() without validation. This allows for arbitrary code execution during the schema parsing phase, even before any actual row data is read. The vulnerability affects any process using Ray Data that reads Parquet files, including via pandas or pyarrow directly. The fix in version 2.55.0 switches the default deserialization to JSON and makes cloudpickle opt-in via an environment variable.
Affected products
- Ray Project Ray 2.49.0 to 2.54.0
Timeline
- 2026-03-25: patched: Fix merged into master branch
- 2026-04-15: advisory: Release of version 2.55.0
- 2026-04-21: disclosed: Security advisory published on GitHub
- 2026-05-08: advisory: NVD publication date