CVE-2025-45691

HighCVSS 7.5

Published: 05/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

41th percentile - higher than 41% of all known CVEs

Summary

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in RAGAS versions 0.2.3 to 0.2.14. It stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.

Risk Assessment

An attacker can read arbitrary files from the system, leading to exposure of sensitive data such as configurations, keys, or user data.

Recommendation

Immediately update RAGAS to version 0.2.15 or later, which includes a fix for URL validation.

Other vulnerabilities in RAGAS

CVE-2026-6587Medium
A server-side request forgery (SSRF) vulnerability has been discovered in the RAGAS library up to version 0.4.3 in the Collections module. The functions _try_process_local_file/_try_process_url in util.py improperly validate the retrieved_contexts argument, allowing a remote attacker to make requests to internal resources. The exploit has been published, and the vendor did not respond.

Original NVD description (English source)

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.