Executive brief
DSPy is a framework for building modular AI systems that work with language models. An attacker who can influence the output of a language model can trick DSPy's Image and Audio components into reading arbitrary files from the server and sending their contents back to the attacker, potentially exposing sensitive configuration, credentials, or other protected data stored on the application server.
Technical details
The vulnerability exists in DSPy 3.3.0b1's Image and Audio output field adapters, which parse untrusted language model completions through JSONAdapter and ChatAdapter. When validating Image or Audio typed outputs, the adapters call encode_image or encode_audio functions that accept filesystem paths in the url field. The vulnerable code uses os.path.isfile to detect local files and then reads them with base64 encoding, automatically embedding file contents into subsequent prompts sent to the attacker's model endpoint. This occurs during TypeAdapter validation with no sanitization of LM-controlled input. The attack requires influence over language model outputs (e.g., injecting a crafted prompt or controlling the model endpoint), but no authentication or user interaction beyond normal DSPy operation. A patch was committed on 2026-07-31 that makes resource loading explicit and requires callers to use dedicated from_path() or from_url() factory methods rather than implicit I/O during validation.
Affected products
- Stanford NLP DSPy 3.3.0b1
Timeline
- 2026-08-11: disclosed
- 2026-07-31: patched: Fix committed to main branch