CVE-2025-45691

CVE-2025-45691 affects VibrantLabs RAGAS (up to v0.4.3); the vulnerability lies in improper validation of URLs in retrieved_contexts during multimodal input processing, enabling Server-Side Request Forgery (SSRF) and arbitrary file reads. Several connected sources describe exploitation via manipu...

CVE-2025-45691

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrievedcontexts parameter when handling multimodal inputs...

Malicious code in test-mlw2-ragas-bides (npm)

The package test-mlw2-ragas-bides was found to contain malicious code...

MAL-2025-36078 Malicious code in test-mlw2-ragas-bides (npm)

The package test-mlw2-ragas-bides was found to contain malicious code...