GHSA-vvw2-h478-xwr3
Medium · 5.9CVSS
5.9
EPSS
—
Published
Nov 4, 2025
CISA due date
—
The record
DSPy does not properly restrict file reads
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | dspy | 0 | No fix |
Related vulnerabilities
- CVE-2025-12695 The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive… Same vulnerability
- CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
- CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
- GHSA-gqmf-56h7-rrpf npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware… CWE-653
- CVE-2026-41155 An attacker could cooperatively pass data from one secure GPU process to another secure… CWE-653
- CVE-2026-42782 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
- CVE-2026-44009 vm2 is an open source vm/sandbox for Node.js. CWE-653
- CVE-2026-44005 vm2 is an open source vm/sandbox for Node.js. CWE-653