CVE-2026-72742 Stanford NLP CVE debrief

Who should care

Defenders and security teams responsible for DSPy deployments, especially those using language models for processing user input, should assess exposure and verify patched versions. This vulnerability requires immediate attention due to its critical severity and potential for file exfiltration.

Why it matters

CVE-2026-72742 is a critical vulnerability in DSPy 3.3.0b1 that allows attackers to exfiltrate files by manipulating language model outputs. Defenders should assess exposure, verify patches, and implement monitoring to prevent data breaches.

• Potential for unauthorized file reads and data exfiltration.
• Risk of sensitive information disclosure through language model interactions.
• Need for verification of patched versions to prevent exploitation.
• Importance of monitoring language model outputs for suspicious file access attempts.

Technical summary

The vulnerability in DSPy 3.3.0b1's Image and Audio output field adapters allows attackers to read arbitrary local files. This is achieved by injecting a filesystem path into the url field of a parsed Image or Audio typed output, which is then processed by the JSONAdapter and ChatAdapter. These adapters parse untrusted language model completions through parse_value into TypeAdapter validation, triggering encode_image or encode_audio to read and base64-encode any local file path.

Defensive priority

High priority for defenders to assess exposure and verify patched versions, especially in deployments using DSPy for language model interactions.

Recommended defensive actions

• Assess exposure in DSPy deployments, especially where language model outputs are influenced by user input.
• Verify if patched versions of DSPy are applied, specifically checking for updates to the Image and Audio output field adapters.
• Implement compensating controls to monitor and restrict file access attempts from language model interactions.
• Review and update incident response plans to address potential file exfiltration scenarios.
• Conduct regular security audits to identify and mitigate potential vulnerabilities in language model interactions.
• Establish a process for rapid patching and deployment of security updates for DSPy and related components.
• Monitor language model outputs for suspicious activity and implement logging and alerting for potential security incidents.

Evidence notes

The vulnerability allows attackers to read local files by injecting paths into Image or Audio output fields. The JSONAdapter and ChatAdapter parse untrusted language model completions, triggering encode_image or encode_audio to read and base64-encode local files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.