PT-2025-45779 · Pypi · Dspy

Publicado 2025-11-04 · Atualizado 2025-11-04

OSV

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.

Correção

Enumeração de Fraquezas

CWE-653

Identificadores relacionados

GHSA-VVW2-H478-XWR3

Produtos afetados

Dspy

Referências · 4

• https://github.com/stanfordnlp/dspy · Nota
• https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652 · Nota
• https://osv.dev/vulnerability/GHSA-vvw2-h478-xwr3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-12695 · Nota de Segurança