CVE-2026-72742
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters. An attacker with influence over language model outputs can read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path, subsequently embedding the contents into outgoing messages to the attacker-controlled endpoint.
Risk Assessment
An attacker can exfiltrate arbitrary files from the system, including sensitive data, potentially leading to confidentiality breaches and data leaks.
Recommendation
Update DSPy to a patched version or restrict trust in language model outputs.
Original NVD description (English source)
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.