CVE-2023-6019 Ray Command Injection in cpu_profile Parameter
Attackers can execute arbitrary OS commands remotely via the Ray dashboard's cpu_profile parameter without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-6019?
CVE-2023-6019 is a critical command injection vulnerability in ray-project/ray, published on 16 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Weakness: CWE-78
Which versions are affected by CVE-2023-6019?
3 open source packages ship an affected version, including ray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ray PyPI | All versions | 2.8.1 |
ray PyPI | All versions | 2.8.1 |
ray PyPI | All versions | 2.8.1 |
Products include Ray Project Ray.
How do I fix CVE-2023-6019?
Upgrade ray to 2.8.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-6019 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6019 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 4 proofs of concept on GitHub.
Other vulnerabilities in ray-project/ray
Sources
Also known as GHSA-h3xg-wv58-5p43, PYSEC-2026-519.