What’s Vulnerable › Vulnerabilities

CVE-2026-72742: DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-73

Description

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

Affected products

• Stanford NLP DSPy: through 3.3.0b1

References

• https://github.com/stanfordnlp/dspy
• https://github.com/stanfordnlp/dspy/commit/c69136b29aca4c00ca6da7667f7b80783188980e
• https://github.com/stanfordnlp/dspy/issues/10067
• https://www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-output-field-parsing

Get alerted when CVE-2026-72742 or the next vulnerability affects your stack