Server-side Request Forgery (SSRF)

Overview ragas is an Evaluation framework for RAG and LLM applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of URLs in the retrievedcontexts parameter when processing multimodal inputs. An attacker can access arbitrary files,...

CVE-2025-45691

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrievedcontexts parameter when handling multimodal inputs...

Malicious code in test-mlw2-ragas-bides (npm)

The package test-mlw2-ragas-bides was found to contain malicious code...

MAL-2025-36078 Malicious code in test-mlw2-ragas-bides (npm)

The package test-mlw2-ragas-bides was found to contain malicious code...