CVE-2026-72742
DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing
Description
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.
INFO
Published Date :
Aug. 11, 2026, 7:18 p.m.
Last Modified :
Oct. 24, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-72742
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | CRITICAL | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Update DSPy to a patched version.
- Validate image and audio output handling.
- Sanitize user-controlled inputs.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72742.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72742 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72742
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72742 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72742 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: DSPy de Stanford NLP, Description: DSPy 3.3.0b1 contiene una vulnerabilidad de exfiltración de archivos en los adaptadores de campo de salida de Imagen y Audio que permite a los atacantes con influencia sobre las salidas del modelo de lenguaje leer archivos locales arbitrarios inyectando una ruta del sistema de archivos en el campo url de una salida tipada de Imagen o Audio analizada. El JSONAdapter y el ChatAdapter analizan las finalizaciones no confiables del modelo de lenguaje a través de parse_value en la validación de TypeAdapter, lo que activa encode_image o encode_audio para leer y codificar en base64 cualquier ruta de archivo local a través de la rama os.path.isfile en image.py y audio.py, incrustando posteriormente el contenido del archivo en los mensajes de prompt salientes enviados al endpoint del modelo controlado por el atacante. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 12, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-72742', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-12T16:05:20.594545Z'} -
New CVE Received by [email protected]
Aug. 11, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Stanford NLP', 'product': 'DSPy', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '3.3.0b1'}], 'defaultStatus': 'affected'}] Added Description DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Added CWE CWE-73 Added Reference https://github.com/stanfordnlp/dspy Added Reference https://github.com/stanfordnlp/dspy/commit/c69136b29aca4c00ca6da7667f7b80783188980e Added Reference https://github.com/stanfordnlp/dspy/issues/10067 Added Reference https://www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-output-field-parsing