AIKIDO-2026-431839

TL;DR

The dspy chat and JSON adapters parse untrusted language model completions into dspy.Image and dspy.Audio typed output fields during validation. When a completion supplies a filesystem path in the url field, the type constructor reaches the os.path.isfile branch in image.py and audio.py, reads that local file, and base64-encodes it. The encoded contents are then embedded into the next outgoing prompt sent to the model endpoint, so any entity that can influence model output can read and exfiltrate arbitrary local files. The fix makes resource construction and validation free of implicit filesystem and network access and requires explicit factory methods to load local or remote resources.