Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

Affected: PyPI: ray

## Summary

`ray.data.read_webdataset(paths=...)` is a `@PublicAPI(stability="alpha")` reader for WebDataset-format TAR files. Its default `decoder=True` invokes `_default_decoder` on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled bytes with no validation:

- `.pickle` / `.pkl` -> `pickle.loads(value)` - `.pt` / `.pth` -> `torch.load(io.BytesIO(value), weights_only=False)`

Both fire during a standard `ray.data.read_webdataset(...).take_all()` / `.iter_batches()` call. No flags, no opt-in, no environment variable. An attacker who can supply a TAR (via S3 share, HuggingFace Hub mirror, email attachment, model-zoo, or any HTTP URL the user passes to `read_webdataset`) achieves arbitrary code execution in the calling Ray process at schema-sample time, before row data is consumed.

This is the same class of bug as GHSA-mw35-8rx3-xf9r (Parquet Arrow Extension Type cloudpickle deserialization, patched in 2.55.0): standard data-loading API, attacker-controlled file format, deserialization gadget invoked transparently. The 2.55.0 patch addressed `tensor_extensions/arrow.py:_deserialize_with_fallback` and made cloudpickle opt-in via `RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1`. The WebDataset path is a different code site and was not touched.

## Vulnerable code (HEAD `a157d4d`)

`python/ray/data/_internal/datasource/webdataset_datasource.py` lines 175-225, the `_default_decoder` function:

``…

Affected: PyPI: ray

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects ray: Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion python: protobuf: Protobuf: Denial of Service due to recursion depth bypass sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing vllm: vLLM: Arbitrary code execution via malicious HuggingFace model vllm: vLLM: Denial of Service via malformed multimodal input or token injection thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files vllm: vLLM: Denial of Service via malformed speculative decoding workload vllm: vLLM: Denial of Service due to improper floating-point validation starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS org.apache.httpcomponents.core5/httpcore5: Apache HttpCo…