Ray Command Injection in cpu_profile Parameter

published 2023-11-16 2 y ago modified 2026-09-10 1 mo ago also GHSA-h3xg-wv58-5p43 , PYSEC-2026-519 , EUVD-2023-2970

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 74.6%; EPSS 74.6% chance of exploitation in 30 days, percentile 99.5%
public exploits: 2; Metasploit, Exploit-DB

A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Patch / fix

fixed in 1 links 1

pypi ray 2.8.1

github.com/ray-project/ray/releases/tag/ray-2.8.1 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-6019 updated 2025-11-21 cvss 9.8

ray: Ray Dashboard Command Injection

Red Hat AI Inference Server rhaiis/vllm-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-rhel8-operator, rhoai/odh-rhel9-operator, rhoai/odh-dashboard-rhel8, rhoai/odh-modelmesh-rhel8, rhoai/odh-modelmesh-rhel9, rhoai/odh-mm-rest-proxy-rhel8, +40 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2023-11-15 First public exploit (Metasploit exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019)
2023-11-16 Published

Exploit prediction

74.63% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019 Ray cpu_profile command injection metasploit exploit, excellent rank, 2023-11-15
EDB-51978 Ray OS v2.6.3 - Command Injection RCE(Unauthorized) webapps, 2024-04-12
huntr.com https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	ray	<2.8.1	2.8.1

Affected products

ray-project ray-project/ray

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

huntr.com /bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe
web, exploit
nvd.nist.gov /vuln/detail/CVE-2023-6019
advisory
github.com /ray-project/ray
web
github.com /ray-project/ray/releases/tag/ray-2.8.1
web
anyscale.com /blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
web
pypi.org /project/ray
package
github.com /advisories/GHSA-h3xg-wv58-5p43
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary