PyPI/ragas CVE-2025-45691: high 7.5, EPSS 0.57%
RAGAS has an Arbitrary File Read vulnerability
Action: Upgrade ragas to 0.3.0-rc1 or later.
pip install ragas==0.3.0-rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.2.3 | 0.3.0-rc1 | - |
Fixed versions
| 0.3.0-rc1 |
Sources
- osv: PYSEC-2026-3047
- https://nvd.nist.gov/vuln/detail/CVE-2025-45691
- https://github.com/explodinggradients/ragas/pull/1559
- https://github.com/vibrantlabsai/ragas/pull/1991
- https://github.com/vibrantlabsai/ragas/commit/b28433709cbedbb531db79dadcfbdbd3aa6adcb0
- https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability
- https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/multi_modal_prompt.py#L202
- https://github.com/vibrantlabsai/ragas
- https://pypi.org/project/ragas
- https://github.com/advisories/GHSA-v2xr-wvrv-p969
CVE-2025-45691 · published · modified · JSON