CVE-2026-6587

Summary

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

Weaknesses

• CWE-918: Server-Side Request Forgery

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

vibrantlabsai RAGAS: vibrantlabsai RAGAS: Server-Side Request Forgery via retrieved_contexts argument manipulation

Additional References

• https://access.redhat.com/security/cve/CVE-2026-6587
• https://bugzilla.redhat.com/show_bug.cgi?id=2459576
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6587.json

References

• https://vuldb.com/vuln/358222
• https://vuldb.com/vuln/358222/cti
• https://vuldb.com/submit/791088
• https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability

• ←Previous
• Next→