DSPy 3.3.0b1 allows an attacker who can influence language model outputs to read arbitrary local files on the host. The vulnerability is triggered when a malicious model supplies an Image or Audio output where the url field contains a filesystem path. During parsing, the adapters validate the output and invoke encode_image or encode_audio, which checks os.path.isfile and if true, reads the file and base64‑encodes its contents. The file data is then embedded in prompt messages that are sent back to the attacker‑controlled model endpoint, exposing local files without authorization. The weakness is a classic Local File Read (CWE‑73) and can leak sensitive data from the VM or host where DSPy runs.

The vulnerability exists only in Stanford NLP’s DSPy 3.3.0b1. No other DSPy versions or products are listed as affected.

The CVSS score of 9.2 indicates a high severity impact, while the EPSS score of <1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker who can control or predict the language model’s output, meaning the threat surface is limited to trusted or compromised model endpoints. If such influence is achieved, the attacker can read any file in the DSPy process’s file system via the parsing component.