SEC.co
Emergency

By vendor

Anyscale vulnerabilities

Known CVEs affecting Anyscale products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-57516HIGH 8.8

    Ray versions before 2.56.0 contain a critical vulnerability in how they process web dataset files. When using the read_webdataset() function, Ray automatically unpacks and deserializes certain file types (pickle and PyTorch model files) from tar archives without validation. An attacker can craft a malicious archive containing specially crafted .pkl, .pickle, .pt, or .pth files that execute arbitrary code when processed. Because Ray distributes this work across remote workers, the malicious code runs on every worker that touches the archive, potentially compromising your entire distributed computing cluster.