Dspy
Monthly
Arbitrary local file read in Stanford NLP's DSPy 3.3.0b1 lets an attacker who controls or influences language-model completions exfiltrate host files by returning an Image or Audio typed output whose url field contains a local filesystem path. When JSONAdapter or ChatAdapter parse the completion, the framework reads and base64-encodes the referenced file and embeds it in the next outbound prompt to the attacker-controlled model endpoint. Reported by VulnCheck with a CVSS 4.0 base of 9.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary local file read in Stanford NLP's DSPy 3.3.0b1 lets an attacker who controls or influences language-model completions exfiltrate host files by returning an Image or Audio typed output whose url field contains a local filesystem path. When JSONAdapter or ChatAdapter parse the completion, the framework reads and base64-encodes the referenced file and embeds it in the next outbound prompt to the attacker-controlled model endpoint. Reported by VulnCheck with a CVSS 4.0 base of 9.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.