LiveActive security incident?Get immediate response
CVE Record

CVE-2026-72742: DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

CriticalCVSS 9.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A malicious or compromised language-model endpoint can make vulnerable DSPy applications read local files and send their contents back in later model requests. Secrets, credentials, configuration, and customer data readable by the DSPy process may be exposed. The supplied record identifies DSPy 3.3.0b1 and rates the issue critical at CVSS 9.2.

Executive priority

Treat confirmed vulnerable deployments as an immediate remediation priority, particularly where DSPy can read production secrets or regulated data. Isolate risky model integrations and reduce filesystem access while engineering verifies vendor guidance. No active exploitation is established, but the low-complexity disclosure path and potential cross-system confidentiality impact justify urgent action.

Technical view

In DSPy 3.3.0b1, JSONAdapter and ChatAdapter pass untrusted Image or Audio output values through parse_value and TypeAdapter validation. A filesystem path placed in the url field reaches encode_image or encode_audio, whose os.path.isfile handling reads and base64-encodes the file. That data is then embedded in an outgoing prompt to the model endpoint.

Likely exposure

Exposure requires DSPy 3.3.0b1, Image or Audio typed-output parsing, attacker influence over model completions, and readable local files. Risk is greatest with untrusted, attacker-controlled, or compromised model endpoints and processes holding credentials or sensitive data. The bundle's generic affected-version entry is ambiguous, so inventories should verify the exact installed release.

Exploitation context

The supplied sources do not establish active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation depends on influencing language-model output rather than directly supplying a conventional file request. Successful abuse can disclose files readable by the DSPy process through subsequent outbound model traffic.

Researcher notes

The trust-boundary failure occurs when untrusted model output is validated as media and interpreted as a local path. Investigation should trace parsed url values into encode_image and encode_audio, then determine whether resulting content reaches outbound prompts. A patch commit is referenced, but the bundle does not identify a fixed release or confirm broader affected versions.

Mitigation direction

  • Review the vendor issue and patch commit, then deploy a vendor-confirmed release containing the correction.
  • Avoid vulnerable Image and Audio typed-output parsing with untrusted model endpoints until remediation is confirmed.
  • Restrict the DSPy process to only necessary files and remove unnecessary local secrets.
  • Limit model endpoints and outbound destinations to trusted, approved services.

Validation and detection

  • Inventory DSPy installations and confirm whether version 3.3.0b1 is present.
  • Identify workflows using JSONAdapter or ChatAdapter with Image or Audio output fields.
  • Review model providers, endpoint configuration, and who can influence model completions.
  • Inspect outbound model requests and logs for unexpected encoded file content, without exposing sensitive data.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-73: File access and web shell behavior lookup

File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-72742 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.2CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——VulnCheck
8.6CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

9.2Critical
CVSS 4.0 vector shape for CVE-2026-72742Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Stanford NLPDSPy0affected
Weakness

CWE details

CWE-73

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-73 · source CWE mapping

External Control of File Name or Path

External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs