EUVD-2026-95106
GHSA-h4xc-3qfq-jf93
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Unauthenticated loopback endpoint (PR:N) reachable via browser (AV:N/AC:L) but requires the developer to visit a malicious page (UI:R); blind CSRF limits confidentiality (C:L) while tool execution drives integrity (I:H).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 pypi packages depend on pydantic-ai (1 direct, 0 indirect)
- 4 pypi packages depend on pydantic-ai-slim (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.34.0 and other introduced versions.
DescriptionCVE.org
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.
Articles & Coverage 1
AnalysisAI
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit while Agent.to_web() or clai web is running to fire forged chat requests at the loopback-hosted server, causing the served agent to start a run and execute its tools with the privileges and credentials of the local process. The pre-patch /api/chat endpoint performed no Content-Type validation, so a malicious page can deliver a JSON body cross-origin using a CORS-safelisted content type (text/plain, multipart/form-data, application/x-www-form-urlencoded, or none at all) without triggering a preflight; binding the server to localhost - the default - provides no protection because a browser page can reach 127.0.0.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the developer be actively serving an agent via `Agent.to_web()` or the `clai web` development chat UI (the vulnerable surface; binding to localhost/127.0.0.1 is the default and does NOT mitigate, since a browser page can reach the loopback address), AND that the same developer, in the same browser, visits an attacker-controlled page while the server is running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-exploitable CSRF flaw (CWE-352) in a developer-facing feature, not a drive-everywhere critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade `pydantic-ai` and `pydantic-ai-slim` to 1.107.4 (1.x line) or 2.28.0 (2.x line), which enforce `Content-Type: application/json` on `/api/chat` and reject everything else with HTTP 415 before the body is parsed, and keep the CORS preflight handler free of `Access-Control-Allow-*` headers; the fix is delivered via pull requests 7382/7383 and commits d2690201a1834005d382dbf5c47e0ed94ef8bf46 and dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0, with release notes at the v1.107.4 and v2.28.0 tags (full advisory: https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, direct developers to stop running Pydantic AI's Agent.to_web() and clai web unless in an isolated VM or container with no access to production credentials, sensitive source code, or business data, and avoid browsing untrusted websites in the same environment; if the dev UI must run, disable or narrow agent tools to the minimum necessary and do not rely on requires_approval=True. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today