DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/stanfordnlp/dspy
disclosure@vulncheck.com
https://github.com/stanfordnlp/dspy/commit/c69136b29aca4c00ca6da7667f7b80783188…
disclosure@vulncheck.com
https://github.com/stanfordnlp/dspy/issues/10067
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-o…
disclosure@vulncheck.com