Approved changes feed: RSS · Atom
cpe:2.3:a:vibrantlabsai:ragas:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Vibrantlabsai (cf8da740-7e20-5a19-9eb0-44d97cee3de9) |
|---|---|
| Product | Ragas (13d53a4c-d931-56e3-9cca-ebc8da4ab324) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/vibrantlabsai/ragas |
purl2cpe | 2026-07-28 16:40:57.248656 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-6587 |
vulnerable | 2026-06-08 08:07:04.916892 |
vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery
MEDIUM (6.3)
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-20T00:00:19.515Z
Updated: 2026-07-15T00:41:18.374Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-45691 |
vulnerable | 2026-06-08 07:25:11.065000 |
Details available
An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.
Published: 2026-03-05T00:00:00.000Z
Updated: 2026-07-15T01:26:17.573Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.