Log in Start free

Vulnerability · Published Apr 20, 2026 · Assigned by VulDB

CVE-2026-6587vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in RAGAS from vibrantlabsai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 79.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIragasno fix listedGHSA-95ww-475f-pr4f
PyPIragasno fix listedPYSEC-2026-3046

Affected products (as reported)

VendorProductVersions
vibrantlabsai RAGAS 0.4.00.4.10.4.20.4.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References