Executive brief
Ray is a framework used for scaling Python and machine learning workloads. A vulnerability in its data-loading component allows an attacker to execute arbitrary code on a user's system if the user processes a specially crafted dataset file (WebDataset format). This could lead to full system compromise, data theft, or unauthorized access to cloud environments where Ray is running.
Technical details
The `ray.data.read_webdataset` API uses a default decoder that automatically processes file extensions within TAR archives. Specifically, files with `.pickle`/`.pkl` extensions are passed to `pickle.loads()`, and files with `.pt`/`.pth` extensions are passed to `torch.load()` with `weights_only=False`. Both of these functions are known to be unsafe when processing untrusted data as they allow for arbitrary object reconstruction and code execution. An attacker can trigger this by providing a malicious TAR file via a URL, S3 bucket, or other supported path. The vulnerability exists because these unsafe branches are enabled by default without user opt-in or validation. The issue was addressed in version 2.56.0 by requiring explicit configuration to load these formats.
Affected products
- ray-project ray < 2.56.0
Timeline
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-24: patched: Vulnerability fixed in version 2.56.0