---
id: CVE-2025-12695
aliases:
  - GHSA-vvw2-h478-xwr3
  - PYSEC-2026-1318
title: DSPy does not properly restrict file reads
summary: DSPy does not properly restrict file reads
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: dspy
product: dspy
ecosystem: pip
affected:
  - dspy <= 3.0.3
published: '2025-11-04'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vvw2-h478-xwr3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12695'
  - url: 'https://github.com/stanfordnlp/dspy'
  - url: >-
      https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652
tags:
  - osv
  - pip
epss: 0.00315
epssPercentile: 0.21839
ingestedAt: '2026-07-08T18:25:53.486Z'
---

## Overview

The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.

## Affected packages

- `dspy <= 3.0.3`

## Remediation

Refer to the advisory for the patched release.