Shakevsky

An unsafe deserialization issue exists in the WebDataset reader. An attacker can achieve remote code execution by providing a malicious tar archive to the `read webdataset()` function. The ` default decoder()` function in webdataset datasource.py unconditionally calls `pickle.loads()` on tar entries with .pkl or .pickle extensions and `torch.load()` with `weights only=False` on .pt or .pth entries. This results in the execution of arbitrary code within Ray remote workers on every worker that processes the malicious archive. Deserialization is the process of converting a data format back into an object, which becomes unsafe when untrusted data is processed without validation.

Ray Data registers custom Arrow extension types (`ray.data.arrow tensor`, `ray.data.arrow tensor v2`, and `ray.data.arrow variable shaped tensor`) globally in PyArrow. When PyArrow reads a Parquet file containing these extension types, it invokes the ` arrow ext deserialize ` function on the metadata bytes of the field. The implementation passes these bytes directly to `cloudpickle.loads()`, which allows for arbitrary code execution during schema parsing before any row data is processed. This affects any process using Ray Data that reads Parquet files, including those using `ray.data.read parquet()`, `pyarrow.parquet.read table()`, or `pandas.read parquet()`. An attacker can exploit this by providing a crafted Parquet file containing a column with one of the affected extension type names.