{"id":"CVE-2025-12695","aliases":["EUVD-2025-37741","GHSA-vvw2-h478-xwr3","PYSEC-2026-1318"],"status":"published","title":"Insecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandbox","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00338,"percentile":0.27593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-653"],"published":"2025-11-04T13:24:42Z","modified":"2026-11-05T14:10:00Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dspy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"dspy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.3"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.1.3","0.1.4","0.1.5","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.16","2.5.17","2.5.18","2.5.19","2.5.2","2.5.20","2.5.21","2.5.22","2.5.23","2.5.24","2.5.25","2.5.26","2.5.27","2.5.28","2.5.29","2.5.3","2.5.30","2.5.31","2.5.32","2.5.33","2.5.34","2.5.35","2.5.36","2.5.37","2.5.38","2.5.39","2.5.4","2.5.40","2.5.41","2.5.42","2.5.43","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.0rc1","2.6.0rc11","2.6.0rc2","2.6.0rc3","2.6.0rc4","2.6.0rc5","2.6.0rc6","2.6.0rc7","2.6.0rc8","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.18","2.6.19","2.6.2","2.6.20","2.6.21","2.6.22","2.6.23","2.6.24","2.6.25","2.6.26","2.6.27","2.6.27a1","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.6.9rc1","3.0.0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3"]},{"source":"osv","ecosystem":"PyPI","package":"dspy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.3"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.1.3","0.1.4","0.1.5","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.16","2.5.17","2.5.18","2.5.19","2.5.2","2.5.20","2.5.21","2.5.22","2.5.23","2.5.24","2.5.25","2.5.26","2.5.27","2.5.28","2.5.29","2.5.3","2.5.30","2.5.31","2.5.32","2.5.33","2.5.34","2.5.35","2.5.36","2.5.37","2.5.38","2.5.39","2.5.4","2.5.40","2.5.41","2.5.42","2.5.43","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.0rc1","2.6.0rc11","2.6.0rc2","2.6.0rc3","2.6.0rc4","2.6.0rc5","2.6.0rc6","2.6.0rc7","2.6.0rc8","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.18","2.6.19","2.6.2","2.6.20","2.6.21","2.6.22","2.6.23","2.6.24","2.6.25","2.6.26","2.6.27","2.6.27a1","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.6.9rc1","3.0.0","3.0.0b1","3.0.0b2","3.0.0b3","3.0.0b4","3.0.1","3.0.2","3.0.3"]}],"references":[{"url":"https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652/","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12695","tags":["advisory"]},{"url":"https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vvw2-h478-xwr3","tags":["advisory"]},{"url":"https://github.com/stanfordnlp/dspy","tags":["package"]},{"url":"https://pypi.org/project/dspy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-12695","title":"Insecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandbox","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","status":"published","published":"2025-11-04T13:24:42.358Z","modified":"2025-11-04T14:19:33.945Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-37741","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","status":"published","published":"2025-11-04T13:24:42Z","modified":"2025-11-04T14:19:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-vvw2-h478-xwr3","title":"DSPy does not properly restrict file reads","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","status":"published","published":"2025-11-04T15:31:35Z","modified":"2025-11-04T17:05:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2025-12695","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","status":"published","published":"2025-11-04T14:15:34.087Z","modified":"2026-11-05T14:10:00.273Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-653"],"updated_at":"2026-11-05T19:55:51.56159Z"}],"osv":[{"id":"GHSA-vvw2-h478-xwr3","title":"DSPy does not properly restrict file reads","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","status":"published","published":"2025-11-04T15:31:35Z","modified":"2026-07-07T17:57:24.503135806Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"PYSEC-2026-1318","title":"DSPy does not properly restrict file reads","description":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.","status":"published","published":"2026-07-07T16:03:09.472439Z","modified":"2026-07-07T17:46:39.45285425Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"}]}}