CVE-2026-72742

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72742
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72742.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72742
Published
2026-08-11T18:50:47.811Z
Modified
2026-08-14T03:51:47.636865773Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing
Details

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parsevalue into TypeAdapter validation, which triggers encodeimage or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72742.json",
    "cwe_ids": [
        "CWE-73"
    ]
}
References

Affected packages

Git / github.com/stanfordnlp/dspy

Affected ranges

Type
GIT
Repo
https://github.com/stanfordnlp/dspy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c69136b29aca4c00ca6da7667f7b80783188980e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.3.0b1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.4.13
2.4.14
2.4.15
2.4.16
2.4.17
2.5.0
2.5.1
2.5.10
2.5.11
2.5.12
2.5.13
2.5.14
2.5.15
2.5.16
2.5.17
2.5.18
2.5.19
2.5.2
2.5.20
2.5.21
2.5.22
2.5.23
2.5.24
2.5.25
2.5.26
2.5.27
2.5.29
2.5.3
2.5.30
2.5.31
2.5.32
2.5.33
2.5.34
2.5.35
2.5.36
2.5.37
2.5.38
2.5.39
2.5.4
2.5.40
2.5.41
2.5.42
2.5.43
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.6.0
2.6.0rc1
2.6.0rc10
2.6.0rc2
2.6.0rc3
2.6.0rc4
2.6.0rc5
2.6.0rc6
2.6.0rc7
2.6.0rc8
2.6.0rc9
2.6.1
2.6.10
2.6.11
2.6.12
2.6.13
2.6.14
2.6.15
2.6.16
2.6.17
2.6.18
2.6.19
2.6.2
2.6.20
2.6.21
2.6.22
2.6.23
2.6.24
2.6.25
2.6.26
2.6.27
2.6.27a1
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.9rc1
3.*
3.0.0
3.0.0b1
3.0.0b2
3.0.0b3
3.0.0b4
3.0.1
3.0.2
3.0.3
3.0.4b1
3.0.4b2
3.1.0b1
3.1.1
3.1.2
3.1.3
3.2.0
3.3.0b1
v2.*
v2.4.10
v2.4.11
v2.4.12
v2.4.3
v2.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72742.json"