CVE-2026-72742: DSPy Path Traversal Vulnerability

CVE-2026-72742 Overview

CVE-2026-72742 is a file exfiltration vulnerability in DSPy 3.3.0b1, the Stanford NLP framework for programming language models. The flaw resides in the Image and Audio output field adapters. Attackers who influence language model (LLM) outputs can inject a local filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter then read and base64-encode the referenced file, embedding its contents into outgoing prompt messages sent to the attacker-controlled model endpoint. The issue is tracked as CWE-73: External Control of File Name or Path.

Critical Impact
Remote attackers with control over LLM responses can exfiltrate arbitrary local files readable by the DSPy process, including secrets, tokens, and configuration files.

Affected Products

DSPy 3.3.0b1 (Stanford NLP framework)
Applications using dspy.Image typed output fields with JSONAdapter or ChatAdapter
Applications using dspy.Audio typed output fields with JSONAdapter or ChatAdapter

Discovery Timeline

2026-08-11 - CVE-2026-72742 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72742

Vulnerability Analysis

DSPy converts untrusted LLM completions into typed Python objects through adapter classes. When a signature declares an output field of type dspy.Image or dspy.Audio, the JSONAdapter and ChatAdapter call parse_value, which forwards the raw string into a Pydantic TypeAdapter validation step. Validation then invokes encode_image or encode_audio in image.py and audio.py.

Both encoders inspect the supplied value and take an os.path.isfile branch when the string resolves to a local path. The branch opens the file, base64-encodes its contents, and stores the result in the returned object. DSPy subsequently embeds that encoded blob into the next outbound prompt message, transmitting the file contents to the model endpoint under attacker control.

Root Cause

The adapter treats LLM output as trusted input during type coercion. Resource-loading side effects execute inside validation, so any string that looks like a filesystem path is dereferenced without an allowlist, sandbox, or scheme check. This violates the principle of separating parsing from I/O.

Attack Vector

Exploitation requires influence over the model response, which is trivial in prompt-injection scenarios, jailbroken agents, chained tool calls, or when a malicious model endpoint is proxied into a DSPy pipeline. The attacker instructs the model to emit an Image or Audio object whose url points at a sensitive local file, for example /etc/passwd, ~/.aws/credentials, or .env. On the next round-trip DSPy reads the file, base64-encodes it, and ships it back to the attacker-controlled endpoint.

The upstream fix in commit c69136b29aca4c00ca6da7667f7b80783188980e removes implicit resource loading during validation. Tutorial code was updated to construct multimedia objects explicitly rather than through URL coercion:

text

     "    result = fal_client.result(\"fal-ai/flux-pro/v1.1-ultra\", request_id)\n",
     "    url = result[\"images\"][0][\"url\"]\n",
     "\n",
-    "    return dspy.Image.from_url(url)\n",
+    "    return dspy.Image(url)\n",
     "\n",
     "def display_image(image):\n",
     "    url = image.url\n",

Source: stanfordnlp/dspy commit c69136b

Detection Methods for CVE-2026-72742

Indicators of Compromise

Outbound LLM API requests containing large base64-encoded image_url or audio payloads that were not produced by application code.
DSPy process file-open events targeting sensitive paths such as /etc/passwd, ~/.ssh/, ~/.aws/, or .env files.
LLM completions containing JSON with url values that resolve to local filesystem paths rather than http(s):// or data: URIs.

Detection Strategies

Instrument DSPy adapters or wrap encode_image and encode_audio to log any path resolved through the os.path.isfile branch.
Inspect model completions before adapter parsing and reject Image/Audio fields whose url is not a well-formed remote URL.
Compare outbound prompt payload sizes against a baseline to flag anomalous multimedia embeddings from a text-only pipeline.

Monitoring Recommendations

Enable filesystem auditing on hosts running DSPy agents and alert on reads of secret material by the Python interpreter.
Capture and retain full request/response traffic to LLM providers for retrospective analysis of injected file content.
Track DSPy package versions across environments to identify hosts still running 3.3.0b1.

How to Mitigate CVE-2026-72742

Immediate Actions Required

Upgrade DSPy past commit c69136b29aca4c00ca6da7667f7b80783188980e, which prevents implicit resource loading during adapter validation.
Remove or refactor pipelines that expose dspy.Image or dspy.Audio as output field types until the upgrade is completed.
Rotate any credentials, tokens, or keys that were readable by the DSPy process during the exposure window.

Patch Information

The fix is delivered in the upstream commit fix(adapters): prevent implicit resource loading during validation (#10111). Additional context is available in the DSPy issue tracker (#10067) and the VulnCheck advisory.

Workarounds

Sanitize LLM output before adapter parsing by rejecting any url value that resolves to a local filesystem path.
Run DSPy workers under a dedicated low-privilege user with no read access to secrets, credentials, or configuration files.
Constrain outbound network egress from DSPy hosts to a known allowlist of model endpoints to limit exfiltration paths.

bash

# Pin DSPy to a patched build once released, or install directly from the fix commit
pip install --upgrade \
  "git+https://github.com/stanfordnlp/dspy.git@c69136b29aca4c00ca6da7667f7b80783188980e"

# Verify the installed version
python -c "import dspy; print(dspy.__version__)"