CVE-2023-6019

Deeper analysis

CVE-2023-6019 is a command injection vulnerability in the Ray distributed computing framework, specifically within the cpu_profile URL parameter of the Ray dashboard component. The flaw permits unauthenticated remote attackers to inject and execute arbitrary operating system commands on the host running the dashboard. It carries a CVSS v3.1 score of 9.8 and is tracked under CWE-78. The issue was addressed in Ray version 2.8.1 and later.

An attacker with network access to an exposed Ray dashboard can supply a malicious cpu_profile parameter to run commands with the privileges of the dashboard process, achieving full remote code execution without authentication or user interaction. This allows complete compromise of the underlying system, including data exfiltration, persistence, or lateral movement within an environment.

Ray maintainers published guidance at the referenced Anyscale advisory, confirming the root cause and directing users to upgrade to 2.8.1 or newer. The primary public reference is a huntr.dev bounty report that details the injection vector and reproduction steps.

Ray is widely used for scaling AI and machine-learning workloads, increasing the potential blast radius in research and production clusters. The CVE maintains a high EPSS score with a recorded peak of 0.9422, indicating sustained exploitation interest after disclosure.