Description (CNA)
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vibrantlabsai / RAGAS | affected 0.4.0; affected 0.4.1; affected 0.4.2; affected 0.4.3 |
CWE
CWE-918
References
- https://vuldb.com/vuln/358222
- https://vuldb.com/vuln/358222/cti
- https://vuldb.com/submit/791088
- https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in vibrantlabsai RAGAS. A remote attacker can exploit a server-side request forgery (SSRF) vulnerability by manipulating the retrieved_contexts argument within the _try_process_local_file or _try_process_url functions. This manipulation allows the attacker to induce the server to make arbitrary requests, potentially leading to information disclosure or access to internal resources.