What’s Vulnerable › Vulnerabilities

CVE-2026-6587: vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-20 · updated 2026-10-26
• Weakness: CWE-918

Description

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• vibrantlabsai RAGAS: 0.4.0, 0.4.1, 0.4.2, 0.4.3

References

• https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability
• https://vuldb.com/submit/791088
• https://vuldb.com/vuln/358222
• https://vuldb.com/vuln/358222/cti
• https://access.redhat.com/security/cve/CVE-2026-6587
• https://bugzilla.redhat.com/show_bug.cgi?id=2459576
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6587.json

Get alerted when CVE-2026-6587 or the next vulnerability affects your stack