Summary ray.data.read_webdataset(paths=...) is a @PublicAPI(stability="alpha") reader for WebDataset-format TAR files. Its default decoder=True invokes _default_decoder on every sample's keys, which routes file extensio…
| CVE ID | CVE-2026-57516 |
| Vendor | pip |
| Affected Product | ray |
| Vulnerability Type | Vulnerability |
| CVSS Score | 8.8 (HIGH) |
| EPSS Score | 0.6% probability of exploitation in the next 30 days |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
ray.data.read_webdataset(paths=...) is a @PublicAPI(stability="alpha").pt / .pth -> torch.load(io.BytesIO(value), weights_only=False) Both fire during a standard ray.data.read_webdataset(...).take_all() /reader for WebDataset-format TAR files. Its default decoder=True invokes _default_decoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled bytes with no validation: - .pickle / .pkl -> pickle.loads(value) .iter_batches() call. No flags, no opt-in, no environment variable. An attacker who can supply a TAR (via S3 share, HuggingFace Hub mirror, email attachment, model-zoo, or any HTTP URL the user passes to read_webdataset) achieves arbitrary code execution in the call
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.