PT-2026-23468 · Exploding Gradients · Ragas

Published 2026-03-05 · Updated 2026-03-10 · CVE-2025-45691

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Exploding Gradients RAGAS versions 0.2.3 through 0.2.14

Description An arbitrary file read issue exists in the ImageTextPromptValue class. This is due to insufficient validation and sanitization of URLs provided in the retrieved contexts parameter when processing multimodal inputs.

Recommendations Update to a version of Exploding Gradients RAGAS newer than 0.2.14.

Exploit

Fix

SSRF

Path traversal

Allocation of Resources Without Limits

Weakness Enumeration

CWE-918

CWE-22

CWE-770

Related Identifiers

CVE-2025-45691

GHSA-V2XR-WVRV-P969

Affected Products

Ragas

References · 12

• 🔥 https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability · Exploit
• https://github.com/explodinggradients/ragas/pull/1559 · Patch
• https://github.com/vibrantlabsai/ragas/pull/1991 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-45691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45691 · Security Note
• https://osv.dev/vulnerability/GHSA-v2xr-wvrv-p969 · Vendor Advisory
• https://github.com/vibrantlabsai/ragas · Note
• https://github.com/vibrantlabsai/ragas/commit/b28433709cbedbb531db79dadcfbdbd3aa6adcb0 · Note
• https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202 · Note
• https://twitter.com/CVEnew/status/2030755432013124082 · Twitter Post
• https://t.me/cveNotify/154968 · Telegram Post
• https://t.me/cveNotify/154480 · Telegram Post