CVE-2025-62593

What it actually does

Remote code execution on Ray instances via browser-based DNS rebinding attack that bypasses an insufficient User-Agent header check requiring only a leading Mozilla string.

Why it matters to the business

Developers and organizations using Ray face risk of full system compromise from visiting malicious sites or ads, with CISA-mandated remediation required by 2026-08-20 and rapidly rising exploit likelihood.

How an attack unfolds

An attacker hosts a malicious site or malvertisement that triggers a DNS rebinding attack against a browser; the browser then issues requests to the local Ray instance with a spoofed User-Agent, bypassing the weak Mozilla check and achieving code execution. Active exploitation is occurring in the wild by actors targeting the Ray-Project Ray Code Injection Vulnerability.

How to fix it

Upgrade Ray to version 2.52.0 or later. For Debian 13 systems, upgrade to linux package version 6.11.2-1.

How to confirm the fix worked

Confirm Ray version is 2.52.0 or higher and that Debian linux package is at 6.11.2-1; test that non-Mozilla User-Agent strings are rejected for local API access.

Typical attack path

1. Victim runs Ray and visits attacker-controlled website or receives malvertising
2. Attacker performs DNS rebinding to make browser treat attacker domain as local Ray host
3. Browser sends request with attacker-controlled User-Agent header
4. Ray accepts request due to weak Mozilla prefix check and executes attacker-supplied code

How to detect it

Review web proxy, browser, and local service logs for unexpected connections to Ray ports from external domains combined with User-Agent strings that start with Mozilla but originate from rebinding attempts; look for process execution or file creation artifacts tied to the Ray-Project Ray Code Injection Vulnerability.

• User-Agent header containing Mozilla prefix followed by unexpected content in requests to Ray ports
• DNS responses showing rapid A-record changes targeting localhost or 127.0.0.1
• Unexpected child processes spawned by ray process after browser activity

What your security team should do

• Immediately upgrade all Ray instances to 2.52.0 and Debian linux packages to 6.11.2-1 before the 2026-08-20 KEV deadline
• Monitor EPSS trend and block outbound DNS rebinding attempts from developer workstations
• Add network controls to prevent browser-initiated connections to local Ray ports from untrusted sites