Description

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-11T19:18:49.130Z",
  "pubdate": "2026-08-11T19:18:49.130Z",
  "executiveSummary": "DSPy version 3.3.0b1 contains an arbitrary file exfiltration vulnerability located within its Image and Audio output field adapters. This vulnerability allows an attacker who can influence language model outputs to read arbitrary local files from the host system running the DSPy application. The root cause stems from insecure parsing of untrusted language model completions through `parse_value` into `TypeAdapter` validation, which subsequently triggers `encode_image` or `encode_audio` functions.\nWhen a manipulated language model output is processed, it injects a filesystem path into the `url` field of a parsed Image or Audio typed output. This triggers an `os.path.isfile` check within `image.py` and `audio.py`, causing the application to read the targeted local file, base64-encode its contents, and embed the sensitive data into outgoing prompt messages transmitted to an attacker-controlled model endpoint.\nThe impact of this vulnerability includes unauthorized disclosure of sensitive local files accessible to the application process, potentially exposing configuration files, credentials, or source code. Exploitation requires the attacker to have influence over language model outputs processed by the vulnerable DSPy adapters, thereby redirecting exfiltrated data over the network to an external endpoint.",
  "technicalDetails": "The vulnerability resides in the Image and Audio output field adapters of DSPy version 3.3.0b1, specifically impacting `JSONAdapter`, `ChatAdapter`, and the underlying validation mechanisms in `image.py` and `audio.py`. The root cause is the improper handling and validation of untrusted language model completions during the parsing phase, where structured outputs are processed without adequate sanitization of filesystem paths.\nThe attack flow proceeds as follows: First, an attacker leverages influence over language model outputs to inject a malicious payload containing a local filesystem path within the `url` field of a parsed Image or Audio typed output structure. Second, the `JSONAdapter` or `ChatAdapter` parses the untrusted completion via `parse_value` into `TypeAdapter` validation. Third, validation handling triggers `encode_image` or `encode_audio` functions respectively.\nDuring execution, the vulnerable code evaluates the supplied path using the `os.path.isfile` branch located in `image.py` and `audio.py`. Upon confirming the existence of the file, the application reads the contents of the arbitrary local file from the disk, encodes the raw bytes into base64 format, and embeds the resulting data payload into outgoing prompt messages. Finally, these messages are sent directly to the attacker-controlled model endpoint, completing the exfiltration chain without requiring authentication or elevated privileges beyond controlling or influencing the language model completion stream."
}