agentic-layer-testbench (>=0.9.1, <=0.10.0), agentic-rag-pdf (>=0.1.2, <=0.1.5) +98 more potentially affected by CVE-2025-45691 +1 more via ragas (>=0.2.6, <=0.4.3)

ragas PYPI version =0.2.6, =0.9.1, =0.1.2, =1.1.0a20250502, =1.1.0a20250502, =1.1.0a20250502, =1.1.0rc1, =1.1.0a20250502, =1.1.0a20250502, =1.1.0a20250502, =1.1.0a20250502, =0.12.0, =1.1.0a20251020, =1.1.0a20250429, =1.1.0rc1, =1.4.3 and more Source cves: CVE-2025-45691, CVE-2026-6587 Source...

CVE-2026-6587

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function tryprocesslocalfile/tryprocessurl of the file src/ragas/metrics/collections/multimodalfaithfulness/util.py of the component Collections Module. Performing a manipulation of the argument...

CVE-2026-6587

A server-side request forgery (SSRF) vulnerability exists in vibrantlabsai RAGAS versions up to 0.4.3 (specifically prior to 0.4.4 ). The flaw is located in the Collections Module within the src/ragas/metrics/collections/multi_modal_faithfulness/util.py file, specifically affecting the _try_proce...