CVE-2025-45691
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 5, 2026
- Updated
- Jul 15, 2026
- Reserved
- Apr 22, 2025
Description
An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability
- https://github.com/explodinggradients/ragas/pull/1559
- https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202
- https://github.com/vibrantlabsai/ragas/pull/1991
- https://access.redhat.com/security/cve/CVE-2025-45691vdb-entry
- RHBZ#2444875issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-45691.json
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.