CVE-2026-72742 DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing
Attackers can read arbitrary local files by injecting paths into image or audio output fields, exposing sensitive data to attacker-controlled endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72742?
CVE-2026-72742 is a critical path traversal vulnerability in Stanford NLP DSPy, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.
Weakness: CWE-73
Which versions are affected by CVE-2026-72742?
How do I fix CVE-2026-72742?
No fix has been published for CVE-2026-72742 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72742 being exploited?
There is no known exploitation of CVE-2026-72742 in the wild and no public exploit code.
Sources
Also known as GHSA-vg2p-rf25-4wrx.