CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

The US Cybersecurity and Infrastructure Security Agency has added a critical vulnerability in Ray to its list of known exploited vulnerabilities, indicating that it is being actively exploited. Ray is a distributed computing framework used for artificial intelligence and machine learning workloads. The framework is open-source and Python-native, designed to support scaling of these workloads. The vulnerability can trigger remote code execution in a browser-based setting. The Ray project on GitHub has a significant following, with over a certain number of users at the time of reporting.