Description (CNA)
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Stanford NLP / DSPy | affected 0 through 3.3.0b1 |
CWE
CWE-73
References
- https://github.com/stanfordnlp/dspy
- https://github.com/stanfordnlp/dspy/issues/10067
- https://github.com/stanfordnlp/dspy/commit/c69136b29aca4c00ca6da7667f7b80783188980e
- https://www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-output-field-parsing
ADP enrichment
No English description supplied.
No references supplied.