PT-2026-23468 · Exploding Gradients · Ragas

CVE-2025-45691 · Published 2026-03-05 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Exploding Gradients RAGAS versions 0.2.3 through 0.2.14

Description An arbitrary file read issue exists in the ImageTextPromptValue class. This is due to insufficient validation and sanitization of URLs provided in the retrieved contexts parameter when processing multimodal inputs.

Recommendations Update to a version of Exploding Gradients RAGAS newer than 0.2.14.

Exploit

Fix

SSRF

Allocation of Resources Without Limits

Path traversal

Weakness Enumeration

CWE-918

CWE-770

CWE-22

Related Identifiers

CVE-2025-45691

GHSA-V2XR-WVRV-P969

PYSEC-2026-3047

Affected Products

Ragas

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45691.json · Exploit
• 🔥 https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability · Exploit
• https://github.com/vibrantlabsai/ragas/pull/1991 · Vendor Advisory
• https://github.com/explodinggradients/ragas/pull/1559 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-45691 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-3047 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2xr-wvrv-p969 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-45691 · Vendor Advisory
• https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202 · Note
• https://github.com/vibrantlabsai/ragas · Note
• https://github.com/vibrantlabsai/ragas/commit/b28433709cbedbb531db79dadcfbdbd3aa6adcb0 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-45691.json · Note
• https://t.me/cveNotify/154480 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-45691 · Note
• https://pypi.org/project/ragas · Note