## Overview
CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog on August 17, 2026. This vulnerability affects Ray, an AI compute engine, prior to version 2.52.0. It allows remote code execution (RCE) via browser exploitation, specifically through Firefox and Safari. The addition to the KEV list signals a federal deadline for remediation, highlighting the urgency of the threat.
## Technical Details
The vulnerability stems from an insufficient defense against browser-based attacks. Ray's current protection mechanism relies on the User-Agent header starting with "Mozilla". This approach is flawed because the fetch specification permits modification of the User-Agent header. Attackers can exploit this weakness through DNS rebinding attacks, targeting developers who may inadvertently visit malicious websites or encounter malvertising.
## Impact
Developers using Ray as a development tool are at risk of RCE if they are running versions prior to 2.52.0. Successful exploitation could allow attackers to execute arbitrary code on the developer's machine, leading to potential data breaches or system compromise. The CVSS score of 9.4 indicates the severity of this vulnerability.
## Mitigation
Ray-Project has released version 2.52.0 to address this vulnerability. All users are strongly advised to upgrade to this version immediately to mitigate the risks associated with CVE-2025-62593. Additionally, developers should implement best practices for web security and remain vigilant against potential phishing and malvertising attacks.
CSURFACE Threat Sensor