CVE-2026-72742

Received Received - Intake

DSPy File Exfiltration via Image Audio Adapters

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-72742

EUVD

EUVD-2026-56886

Affected Vendors & Products

Vendor	Product	Version / Range
stanfordnlp	dspy	to 3.3.0b1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability in DSPy 3.3.0b1 allows attackers to read arbitrary local files by injecting a filesystem path into the url field of an Image or Audio output field. The system's JSONAdapter and ChatAdapter parse untrusted language model outputs, triggering encode_image or encode_audio functions that read and base64-encode local files without proper validation.

Detection Guidance

To detect this vulnerability, monitor for unexpected file reads or base64-encoded file contents in outgoing network traffic from your DSPy application. Check logs for Image or Audio output fields receiving untrusted paths like /etc/passwd or similar sensitive files. Use network monitoring tools to inspect prompts sent to model endpoints for embedded file data.

Impact Analysis

Attackers can exfiltrate sensitive files from your system by manipulating language model outputs. The vulnerability allows reading any local file and embedding its contents into outgoing prompts sent to attacker-controlled endpoints, potentially exposing confidential data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable DSPy versions may face compliance breaches and regulatory penalties.

Mitigation Strategies

Upgrade DSPy to a patched version where explicit resource loading is enforced, such as using Image.from_path() or Audio.from_url() instead of direct constructors.
Review and update DSPy adapters (JSONAdapter, ChatAdapter) to reject untrusted inputs during parsing, particularly for Image and Audio fields.
Implement input validation to block filesystem paths or URLs in untrusted outputs, and add SSRF allowlists for URL fetching.
Audit existing DSPy signatures and workflows to ensure no implicit file reads occur during type validation.

Hi! I’m here to help you understand CVE-2026-72742. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70