What happened
NVD published CVE-2026-72742 (CVSS 8.6, High) describing an arbitrary local file-read vulnerability triggered by attacker-influenced LLM output in DSPy's structured-output adapters.
Why it matters
DSPy is a widely-used Stanford NLP framework for programming LLM pipelines; this shows a broader pattern where structured-output parsing trusts LLM-generated content as if it were developer-controlled, letting an attacker who can influence model output (via prompt injection or a compromised model) exfiltrate local files from the host running the pipeline.
Attack vector
JSONAdapter and ChatAdapter parse untrusted LLM completions through parse_value into TypeAdapter validation; a filesystem path injected into a parsed Image or Audio typed output's url field triggers encode_image/encode_audio to read and base64-encode any local file, exfiltrating it back through the model's response pipeline.
Affected systems
DSPy 3.3.0b1
Mitigation
Upgrade DSPy when a fix is released; validate/restrict url fields in typed Image/Audio outputs to remote HTTP(S) URLs only, rejecting local file paths.