HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-72742 — DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio o...

·Source: NIST NVD

Updated:

Executive Summary

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter v

Analysis

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint. CVSS Score: 8.6. Published: 2026-08-11T19:18:49.130.

Indicators of Compromise (1)

CVE (1)
CVE-2026-72742
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

China-Linked Hacker Shows AI Capabilities in APAC Attack

In the first purported "near-autonomous" attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan.

Dark Reading
MEDIUMVulnerability

Stablecoins offer little cost or speed advantage for remittances - Banca d'Italia

Stablecoins show no systematic cost advantage over traditional remittance channels for cross-border payments, researchers at Banca d'Italia have found.

Finextra
MEDIUMVulnerability

Mobile wallets gain traction in the UK

Cards continue to dominate UK payments but mobile wallets are increasingly popular, with nearly two thirds of the population registered with at least one provider, according to the latest industry data.

Finextra