CVE-2025-12695 Overview
CVE-2025-12695 affects the DSPy framework, a library used to build AI agents and language model pipelines. The vulnerability stems from an overly permissive sandbox configuration in the PythonInterpreter class. Attackers can escape the intended execution boundary and read arbitrary files from the host system. Exploitation targets AI agents that accept untrusted user input and pass it to PythonInterpreter for code execution. The issue was published to the National Vulnerability Database (NVD) on November 4, 2025 and is classified under [CWE-653] Improper Isolation or Compartmentalization.
Critical Impact
Attackers can steal sensitive files from systems hosting DSPy-based AI agents that evaluate user-controlled Python code inside PythonInterpreter.
Affected Products
- DSPy framework (versions using the vulnerable PythonInterpreter sandbox configuration)
- AI agents built on DSPy that accept user input into PythonInterpreter
- Downstream applications integrating DSPy code execution components
Discovery Timeline
- 2025-11-04 - CVE-2025-12695 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12695
Vulnerability Analysis
DSPy provides a PythonInterpreter class that executes Python code inside a sandbox. The sandbox aims to constrain what user-supplied or model-generated code can do at runtime. The configuration ships with permissions broader than required for typical agent workflows. This mismatch between the intended isolation model and the effective policy creates an escape path.
The vulnerability manifests when a developer builds an AI agent that forwards user input into PythonInterpreter. An attacker crafts input that leverages the loose sandbox policy to read files outside the intended scope. The primary impact is confidentiality: attackers extract API keys, tokens, configuration files, or other sensitive data present on the host. Integrity and availability are not directly affected, consistent with the CWE-653 classification.
Exploitation requires network-reachable access to the agent interface and the ability to influence code sent to the interpreter. Attack complexity is elevated because the target application must expose the interpreter to user input in a functional path.
Root Cause
The sandbox permission set in the PythonInterpreter class does not enforce restrictions sufficient to block filesystem reads outside the working scope. The defense-in-depth boundary that isolates untrusted code from host resources is incomplete. See the JFrog Vulnerability Report for technical details on the sandbox bypass primitives.
Attack Vector
An attacker sends prompts or structured input to a DSPy-powered agent. The agent constructs Python code that reaches PythonInterpreter.execute. The attacker-controlled portion invokes filesystem read operations that the sandbox fails to intercept. Contents of arbitrary readable files are returned in the agent response or through a side channel controlled by the attacker.
Refer to the JFrog Vulnerability Report for proof-of-concept technical details.
Detection Methods for CVE-2025-12695
Indicators of Compromise
- Agent logs containing Python payloads that reference sensitive paths such as /etc/passwd, ~/.aws/credentials, .env, or SSH private keys
- Outbound responses from AI endpoints containing file contents that do not correspond to expected agent output
- Unexpected calls to open(), read(), pathlib.Path, or os module functions inside interpreter execution traces
Detection Strategies
- Instrument PythonInterpreter execution to log all executed code and flag filesystem access primitives
- Deploy input validation that inspects LLM-generated tool calls before dispatch to the interpreter
- Correlate agent request telemetry with process-level file access on the host running the DSPy service
Monitoring Recommendations
- Track read operations on secrets directories from processes hosting DSPy applications
- Alert on interpreter sessions whose output size or content signature deviates from baseline
- Forward AI agent audit logs to a centralized SIEM for retention and correlation with host telemetry
How to Mitigate CVE-2025-12695
Immediate Actions Required
- Audit all DSPy deployments to identify agents that pass user input into PythonInterpreter
- Disable the PythonInterpreter tool in production agents until a hardened configuration is applied
- Rotate credentials and secrets accessible from hosts running vulnerable DSPy agents
- Restrict agent host filesystem permissions to only files required for operation
Patch Information
Consult the JFrog Vulnerability Report and the DSPy project repository for the fixed version and configuration guidance. Upgrade to a release that ships a restrictive sandbox policy for PythonInterpreter.
Workarounds
- Run DSPy agents inside a container or microVM with a read-only root filesystem and no mounted secrets
- Enforce an allowlist of Python operations by wrapping PythonInterpreter with a stricter execution policy
- Isolate the interpreter process using seccomp, AppArmor, or SELinux to block filesystem reads outside a defined working directory
- Remove environment variables containing credentials from the interpreter process context
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
