EUVD-2026-23727
GHSA-95ww-475f-pr4f
Severity by source
Sources disagree (Low–High)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: VulDB
Lifecycle Timeline
8DescriptionCVE.org
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in vibrantlabsai RAGAS up to version 0.4.3 allows authenticated remote attackers to manipulate the retrieved_contexts argument in the Collections Module's _try_process_local_file and _try_process_url functions, enabling arbitrary file reads and network requests with the application's privileges. Publicly available exploit code exists; the vendor has not responded to early disclosure attempts despite the security patch for related CVE-2025-45691 being applied to a different module only.
Technical ContextAI
RAGAS (Retrieval-Augmented Generation Assessment) is a library for evaluating retrieval-augmented generation systems. The vulnerability resides in the Collections Module at src/ragas/metrics/collections/multi_modal_faithfulness/util.py, specifically in functions _try_process_local_file and _try_process_url. These functions process file paths and URLs from the retrieved_contexts parameter without adequate input validation or URL scheme filtering, allowing an attacker to direct the application to fetch arbitrary remote resources or access local files via file:// URIs. This is a classic Server-Side Request Forgery (CWE-918) vulnerability where user-controlled input is passed to a fetch/request function without sanitization. The vulnerability affects all versions of vibrantlabsai:ragas from 0.1.x through 0.4.3 based on CPE data.
RemediationAI
Upgrade vibrantlabsai RAGAS to a version beyond 0.4.3 once a patched release becomes available. However, no patched version has been publicly announced by the vendor to date. As an immediate compensating control, restrict the retrieved_contexts parameter to whitelisted domains and file paths only-implement a strict validation function that rejects any retrieved_contexts entries containing unexpected schemes (reject file://, gopher://, etc.) or IP addresses outside your internal network whitelist. Additionally, disable or restrict access to the Collections Module's multi_modal_faithfulness metrics functionality if it is not actively used in your deployment, reducing the attack surface. Deploy the application behind an authentication gateway requiring strong credentials and consider implementing network segmentation to prevent SSRF attacks from reaching sensitive internal services (databases, metadata endpoints, cloud IAM services on 169.254.169.254). Monitor outbound connections from the RAGAS process for unexpected requests to internal IPs or external hosts. Given the vendor's non-responsiveness, consider forking the library or applying a source patch that validates and sanitizes the retrieved_contexts argument before passing it to file-fetch operations.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today