CVE-2025-45691

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-45691
An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability Exploit Third Party Advisory
https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202 Product
https://github.com/explodinggradients/ragas/pull/1559 Exploit Issue Tracking Patch
https://github.com/vibrantlabsai/ragas/pull/1991 Exploit Issue Tracking Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vibrantlabsai:ragas:*:*:*:*:*:*:*:*
History

10 Mar 2026, 19:38

Type Values Removed Values Added
References () https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability - () https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability - Exploit, Third Party Advisory
References () https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202 - () https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202 - Product
References () https://github.com/explodinggradients/ragas/pull/1559 - () https://github.com/explodinggradients/ragas/pull/1559 - Exploit, Issue Tracking, Patch
References () https://github.com/vibrantlabsai/ragas/pull/1991 - () https://github.com/vibrantlabsai/ragas/pull/1991 - Exploit, Issue Tracking, Patch, Vendor Advisory
CPE cpe:2.3:a:vibrantlabsai:ragas:*:*:*:*:*:*:*:*
First Time Vibrantlabsai ragas
Vibrantlabsai
Summary
  • (es) Una vulnerabilidad de lectura arbitraria de archivos existe en la clase ImageTextPromptValue en Exploding Gradients RAGAS v0.2.3 a v0.2.14. La vulnerabilidad se origina en la validación y saneamiento inadecuados de las URL proporcionadas en el parámetro retrieved_contexts al manejar entradas multimodales.

06 Mar 2026, 10:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-22

05 Mar 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-05 19:16

Updated : 2026-03-10 19:38

NVD link : CVE-2025-45691

Mitre link : CVE-2025-45691

CVE.ORG link : CVE-2025-45691

JSON object : View

Products Affected

vibrantlabsai

  • ragas
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')