ray-project — Vulnerabilities & Security Advisories 7

Ray-project is an open-source framework for building distributed applications, commonly used in machine learning and data processing environments. Historically, it has been susceptible to remote code execution (RCE) vulnerabilities, cross-site scripting (XSS), and privilege escalation flaws, often stemming from improper input validation and insecure deserialization. The project has addressed multiple critical security issues, including a 2023 RCE vulnerability (CVE-2023-48022) that allowed attackers to execute arbitrary code through crafted serialized data. While no major public breaches have been reported, the consistent discovery of similar vulnerability classes suggests ongoing challenges in securing its distributed computing components.