Junglewise Threat Intelligence

CVE-2025-45691: Exploding Gradients RAGAS arbitrary file read in ImageTextPromptValue

CVE-2025-45691 · Severity: high · CVSS 7.5 · Published 2026-03-05

Vendors: PyPI, Red Hat.

Executive brief

RAGAS, a framework used to evaluate Retrieval-Augmented Generation (RAG) systems, contains a security flaw in how it handles image and text inputs. An attacker can provide a specially crafted web address (URL) that tricks the system into reading sensitive files from the server's local storage or accessing private internal network services. This could lead to the theft of confidential data, such as system passwords or cloud service credentials, potentially compromising the entire server environment.

Technical details

An arbitrary file read vulnerability exists in the ImageTextPromptValue class within RAGAS versions 0.2.3 through 0.2.14. The flaw stems from improper validation and sanitization of URLs provided in the 'retrieved_contexts' parameter when handling multimodal inputs. Specifically, the 'is_image' check can be bypassed using URL fragments (e.g., 'file://localhost/etc/passwd#payload.jpg'), which causes Python's mimetypes to identify the string as an image while 'urllib.request.urlopen' retrieves the local file. An unauthenticated remote attacker can exploit this to read sensitive local files, perform internal port scans, or access cloud metadata (SSRF). The issue has been addressed in subsequent updates and pull request #1991.

Affected products

  • Exploding Gradients RAGAS 0.2.3 to 0.2.14
  • Red Hat Red Hat OpenShift AI (RHOAI)

Timeline

  • 2024-10-25: other: Vulnerability introduced in v0.2.3 via multimodal support PR
  • 2025-05-05: patched: Fix merged in pull request 1991
  • 2026-03-05: advisory: CVE-2025-45691 published

References

Related threats