Is CVE-2025-45691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-45691 being exploited in the wild.

How severe is CVE-2025-45691?

High severity, with a CVSS score of 7.5, published 5 March 2026.

Which products and versions are affected?

ragas (PyPI) ECOSYSTEM:introduced=0.2.3,fixed=0.3.0-rc1.

Is there a fix for CVE-2025-45691?

Yes. ragas (PyPI): upgrade to 0.3.0-rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-45691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-45691?

Check whether you run ragas (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-45691: Exploding Gradients RAGAS arbitrary file read in ImageTextPromptValue

CVE-2025-45691 · Severity: high · CVSS 7.5 · Published 2026-03-05

RAGAS, a framework used to evaluate Retrieval-Augmented Generation (RAG) systems, contains a security flaw in how it handles image and text inputs. An attacker can provide a specially crafted web address (URL) that tricks the system into reading sensitive files from the server's local storage or accessing private internal network services. This could lead to the theft of confidential data, such as system passwords or cloud service credentials, potentially compromising the entire server environment.

Vendors: PyPI.

Quick answers

Is CVE-2025-45691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-45691 being exploited in the wild.
How severe is CVE-2025-45691?: High severity, with a CVSS score of 7.5, published 5 March 2026.
Which products and versions are affected?: ragas (PyPI) ECOSYSTEM:introduced=0.2.3,fixed=0.3.0-rc1.
Is there a fix for CVE-2025-45691?: Yes. ragas (PyPI): upgrade to 0.3.0-rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-45691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-45691?: Check whether you run ragas (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ragas (PyPI): upgrade to 0.3.0-rc1 or later
```
pip install "ragas>=0.3.0-rc1"
```

Technical details

An arbitrary file read vulnerability exists in the ImageTextPromptValue class within RAGAS versions 0.2.3 through 0.2.14. The flaw stems from improper validation and sanitization of URLs provided in the 'retrieved_contexts' parameter when handling multimodal inputs. Specifically, the 'is_image' check can be bypassed using URL fragments (e.g., 'file://localhost/etc/passwd#payload.jpg'), which causes Python's mimetypes to identify the string as an image while 'urllib.request.urlopen' retrieves the local file. An unauthenticated remote attacker can exploit this to read sensitive local files, perform internal port scans, or access cloud metadata (SSRF). The issue has been addressed in subsequent updates and pull request #1991.

Affected products

Exploding Gradients RAGAS 0.2.3 to 0.2.14
Red Hat Red Hat OpenShift AI (RHOAI)

Identifiers

CVE-2025-45691
GHSA-v2xr-wvrv-p969
PYSEC-2026-3047

Timeline

2024-10-25: other: Vulnerability introduced in v0.2.3 via multimodal support PR
2025-05-05: patched: Fix merged in pull request 1991
2026-03-05: advisory: CVE-2025-45691 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.