Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2026-72742DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

High 8.6

In plain English

A high-severity security flaw in DSPy from Stanford NLP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

Affected products (as reported)

Vendor	Product	Versions
Stanford NLP	DSPy	0 – through 3.3.0b1

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Product Repository product
GitHub Issue issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-output-field-parsing third-party-advisory