جزئیات آسیب‌پذیری

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

• https://github.com/stanfordnlp/dspy product
• https://github.com/stanfordnlp/dspy/issues/10067 issue-tracking
• https://github.com/stanfordnlp/dspy/commit/c69136b29aca4c00ca6da7667f7b80783188980e patch
• https://www.vulncheck.com/advisories/dspy-0b1-local-file-read-via-image-audio-output-field-parsing third-party-advisory