Vendor
An unsafe deserialization vulnerability (CVE-2026-57516) exists in the WebDataset reader of the Ray framework prior to version 2.56.0, allowing remote attackers to achieve arbitrary code execution on Ray remote workers by supplying a malicious tar archive to the `read_webdataset()` function, which then unconditionally calls `pickle.loads()` on .pkl/.pickle entries or `torch.load()` with `weights_only=False` on .pt/.pth entries, executing arbitrary code.