Pydantic AI CVE-2026-107288

Exploitation requires that the deploying application (a) uses pydantic-ai/pydantic-ai-slim version 1.77.0-1.107.5 or 2.0.0b1-2.44.0, (b) invokes the local web_fetch_tool or the WebFetch local fallback, and (c) relies specifically on blocked_domains (a denylist) to restrict fetch targets - the flaw is a denylist bypass only. The attacker must be able to influence the model's chosen URL (e.g., prompt injection) and supply a host spelling that is DNS-equivalent to a blocked entry (IDNA/fullwidth form, non-ASCII label separator, case variation, or trailing root label). Strong limiting factors: configurations using allowed_domains (allowlist) are NOT affected because unmatched spellings fail closed; the private-IP and cloud-metadata SSRF defenses remain effective, so internal/metadata endpoints are not reachable via this bug; and the attacker can only reach an externally-resolvable host that the operator explicitly tried to blocklist, not arbitrary internal infrastructure.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor-assigned CVSS is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable and unauthenticated, but with high attack complexity and only low confidentiality impact, no integrity or availability impact, and no scope change. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of exploitation probability or active abuse; exploitation status is best characterized as no public exploit identified at time of analysis. The high attack complexity is well-justified: the flaw is a blocklist-normalization bypass (CWE-918 SSRF) that requires the attacker to craft an IDNA-equivalent, non-ASCII-separator, case-varied, or trailing-root-label spelling of an already-blocked host, AND requires the application to be relying on blocked_domains rather than allowed_domains. Critically, the advisory and source diff confirm the blast radius is narrow: allowed_domains fails closed for unmatched spellings, and the separate private-IP and cloud-metadata protections remain fully effective - so this does NOT enable classic SSRF to 169.254.169.254 or internal RFC1918 ranges. The realistic impact is limited to reaching a specific externally-resolvable host the operator tried to blocklist. No data is missing in a way that changes the conclusion; the signals are internally consistent and point to a low real-world risk.

An application uses Pydantic AI's web_fetch_tool (or the WebFetch local fallback) configured with blocked_domains to keep the agent away from a specific host. An attacker who can influence the model's output (e.g., via prompt injection in retrieved content) induces it to request an equivalent spelling of the blocked host - such as an IDNA/fullwidth form or a trailing-dot FQDN - which passes the pre-normalization string comparison and is then fetched by the server with its own privileges. No public exploit code was identified in the provided data.