Vulnerability in Stanford Nlp Dspy
CVE-2026-72742
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (40.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Stanford Nlp Dspy — versions 0
Weakness classification (CWE)
References
- github.com/stanfordnlp/dspy (product)
- github.com/stanfordnlp/dspy/issues/10067 (issue-tracking)
- github.com/stanfordnlp/dspy/commit/c69136b29aca4c00ca6da7667f7b80783188980e (patch)
- www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-output-fi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-72742?
- CVE-2026-72742 is a high-severity vulnerability in Stanford Nlp Dspy, classified under External Control of File Name or Path. CVSS score: 8.6/10. Published 2026-08-11.
- How severe is CVE-2026-72742?
- High severity. CVSS v3 base score is 8.6 out of 10.