Vibrantlabsai Ragas vulnerabilities
2 known vulnerabilities affecting vibrantlabsai/ragas.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2026-6587MEDIUMCVSS 5.3v0.4.0v0.4.1+2 more2026-04-20
CVE-2026-6587 [MEDIUM] CWE-918 CVE-2026-6587: A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request
ghsanvd
CVE-2025-45691HIGHCVSS 7.5≥ 0.2.3, ≤ 0.2.142026-03-05
CVE-2025-45691 [HIGH] CWE-22 CVE-2025-45691: An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients
An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.
ghsanvdosv