CVE-2025-45691

EUVD-2025-208315
An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
vibrantlabsairagas
0.2.3 ≤
𝑥
≤ 0.2.14
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability
https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202
https://github.com/explodinggradients/ragas/pull/1559
https://github.com/vibrantlabsai/ragas/pull/1991