Loading vulnerability…
CVE-2025-62593 is a critical remote code execution vulnerability in Ray, an AI compute engine, affecting versions prior to 2.52.0 when used by developers as a development tool. The flaw stems from an insufficient browser-origin defense on exposed Ray endpoints that attempts to block browser-based access by checking whether the User-Agent header starts with "Mozilla." That protection is inadequate because the browser request model permits modification of the User-Agent header in the relevant attack scenario. An attacker can combine this weakness with DNS rebinding to cause a victim’s browser, particularly Firefox or Safari, to send requests to a locally reachable or otherwise developer-accessible Ray service after the victim visits a malicious website or is exposed to malvertising. This can result in unauthenticated remote code execution against the Ray instance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 3 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A recently disclosed vulnerability referenced as being incorporated quickly (with PoC) into the RondoDox DDoS botnet’s exploit set; the specific affected product/impact is not described in the provided content.
A vulnerability for which public PoC material appears to have been available before CVE publication, and which RondoDox attempted to exploit even before the CVE was published; however, the observed exploit implementation was likely ineffective due to a User-Agent mistake.
Unknown
A critical remote code execution (RCE) vulnerability in Ray (prior to 2.52.0) exploitable via browser-based attacks (Safari/Firefox) using DNS rebinding and User-Agent header manipulation, potentially triggered when a developer visits a malicious site or malvertising.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.