CVE-2026-57516

High

Advisory

Published 1 Jul 2026In the index since 8 Sept 2026

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
raypypi	2.47.1, 2.51.1	2.56.0	2

2 by stars

Chart

Latest

Affected images

Radar Score

jessejesse-chart

1 of the 6 container images this version deploys carry CVE-2026-57516.

Container image	Digest	Package	Fixed in
salehmir/jesse :1.10.10	1afa95f979e9	ray@2.47.1	2.56.0

3,421

skypilotgeek-cookbook

1 of the 3 container images this version deploys carry CVE-2026-57516.

Container image	Digest	Package	Fixed in
berkeleyskypilot/skypilot-nightly :latest	8da2f3cda472	ray@2.51.1	2.56.0

8,923

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
berkeleyskypilot/skypilot-nightly :latest	8da2f3cda472	ray@2.51.1	2.56.0	1
salehmir/jesse :1.10.10	1afa95f979e9	ray@2.47.1	2.56.0	1