Exploding Gradients RAGAS Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read exists in the ImageTextPromptValue class of Exploding Gradients RAGAS, specifically in versions 0.2.3 through 0.2.14. This vulnerability arises from inadequate validation and sanitization of URLs provided in the retrieved_contexts parameter when processing multimodal inputs.

Impact

Exploitation of this vulnerability allows for arbitrary file read, potentially leading to unauthorized access to sensitive files on the server.

Remediation

Users can update to the latest version of Exploding Gradients RAGAS, where this vulnerability has been fixed. Instructions for updating can be found in the project's GitHub repository.