CVE-2026-72742 describes a critical vulnerability in Stanford NLP's DSPy 3.3.0b1 where the Image and Audio output field adapters improperly handle untrusted language model outputs. Specifically, the JSONAdapter and ChatAdapter parse these outputs through parse_value into TypeAdapter validation, which calls encode_image or encode_audio functions. These functions check if a given path is a file using os.path.isfile and then read and base64-encode the file contents. An attacker able to influence the language model output can inject arbitrary filesystem paths into the url field of Image or Audio typed outputs, causing local files to be read and exfiltrated within the outgoing prompt messages sent to the attacker-controlled model endpoint.

This vulnerability allows remote attackers with the ability to influence language model outputs to read arbitrary local files on the system running DSPy 3.3.0b1. The attacker can exfiltrate sensitive data by embedding file contents into prompt messages sent to their controlled endpoint. The CVSS 4.0 score is 9.2 (critical), indicating a high-impact remote attack with no privileges or user interaction required and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict or monitor access to language model output influences and avoid running DSPy 3.3.0b1 in untrusted environments.