Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Ray

CVE-2023-6021: Ray Path Traversal vulnerability

criticalCVSS 3.0 9.3GHSA-3pww-qvr8-6mhp

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Published Nov 16, 2023 · Updated Jan 9, 2025

Affected packages

ray

Ecosystem
PyPI
Affected
< 2.8.1
Fixed in
2.8.1
Check
pip show ray

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Credited to cpropps-sysdig.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Ray vulnerabilities

All Ray entries