CVE-2026-6587: Server-Side Request Forgery in vibrantlabsai RAGAS
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
A server-side request forgery vulnerability exists in vibrantlabsai RAGAS up to version 0.4.3 in the _try_process_local_file and _try_process_url functions of the Collections Module. By manipulating the retrieved_contexts argument, an attacker can cause the server to make unintended requests. The vulnerability is remotely exploitable and publicly disclosed. The vendor has not provided a patch or advisory, and the previously applied patch for CVE-2025-45691 does not address this issue. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to perform server-side request forgery, potentially causing the server to make unauthorized requests to internal or external systems. This can lead to information disclosure or interaction with internal services not otherwise accessible. The impact is rated medium based on the CVSS score of 5.3 and the limited scope of the vulnerability's effects.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. The vendor did not respond to early disclosure and no vendor advisory or fix has been published. Users should monitor the vendor's official channels for updates. Until a patch is released, consider restricting or validating inputs to the affected functions if possible to mitigate SSRF risks.
CVE-2026-6587: Server-Side Request Forgery in vibrantlabsai RAGAS
Description
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 5.3medium
Affected software
pkg:pypi/vibrantlabsai/ragasRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A server-side request forgery vulnerability exists in vibrantlabsai RAGAS up to version 0.4.3 in the _try_process_local_file and _try_process_url functions of the Collections Module. By manipulating the retrieved_contexts argument, an attacker can cause the server to make unintended requests. The vulnerability is remotely exploitable and publicly disclosed. The vendor has not provided a patch or advisory, and the previously applied patch for CVE-2025-45691 does not address this issue. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to perform server-side request forgery, potentially causing the server to make unauthorized requests to internal or external systems. This can lead to information disclosure or interaction with internal services not otherwise accessible. The impact is rated medium based on the CVSS score of 5.3 and the limited scope of the vulnerability's effects.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. The vendor did not respond to early disclosure and no vendor advisory or fix has been published. Users should monitor the vendor's official channels for updates. Until a patch is released, consider restricting or validating inputs to the affected functions if possible to mitigate SSRF risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-19T05:47:10.948Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-6587","vendor":"Red Hat"}]
Threat ID: 69e5704619fe3cd2cd3006c7
Added to database: 04/20/2026, 00:16:06 UTC
Last enriched: 07/17/2026, 09:02:55 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 249
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.