Quick answers
- Is CVE-2026-57516 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57516 being exploited in the wild.
- How severe is CVE-2026-57516?
- High severity, with a CVSS score of 8.8, published 1 July 2026.
- Which products and versions are affected?
- ray (PyPI) < 2.56.0, ECOSYSTEM:introduced=0,fixed=2.56.0.
- Is there a fix for CVE-2026-57516?
- Yes. ray (PyPI): upgrade to 2.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57516 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-57516?
- Check whether you run ray (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ray (PyPI): upgrade to 2.56.0 or later
pip install "ray>=2.56.0"
Technical details
The `ray.data.read_webdataset` API uses a default decoder that automatically processes file extensions within TAR archives. Specifically, files with `.pickle`/`.pkl` extensions are passed to `pickle.loads()`, and files with `.pt`/`.pth` extensions are passed to `torch.load()` with `weights_only=False`. Both of these functions are known to be unsafe when processing untrusted data as they allow for arbitrary object reconstruction and code execution. An attacker can trigger this by providing a malicious TAR file via a URL, S3 bucket, or other supported path. The vulnerability exists because these unsafe branches are enabled by default without user opt-in or validation. The issue was addressed in version 2.56.0 by requiring explicit configuration to load these formats.
Affected products
- ray-project ray < 2.56.0
Identifiers
- CVE-2026-57516
- GHSA-hhrp-gw25-jr43
- PYSEC-2026-2273
Timeline
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-24: patched: Vulnerability fixed in version 2.56.0