Pydantic AI Harness CVE-2026-114386

Exploitation requires the target application to deploy the pydantic-ai-harness CodeMode toolset with run_code enabled AND to rely on an operator-configured UsageLimits.tool_calls_limit for cost or safety control - without that limit there is nothing to bypass. The attacker must be able to influence the sandboxed program's behavior, either as a user of the agent or through prompt-injected content that reaches the agent, causing it to call run_nested_call(). Limiting factors: the flaw only matters where tool_calls_limit is set as a guardrail; impact is bounded to exceeding call counts on costly or side-effecting tools (no data exposure); and it affects only versions before 0.59.0. The AT:P metric reflects this feature-and-configuration dependency.

This is a moderate-risk resource/limit-enforcement flaw (CWE-770), not a code-execution or data-disclosure bug. The vendor CVSS 4.0 score is 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N and impact limited to VI:L/VA:L (no confidentiality, no subsequent-system impact), which aligns well with the description: the only consequence is that an operator-configured UsageLimits.tool_calls_limit is bypassed for nested tool calls, allowing more invocations of costly or side-effecting tools than intended. The AT:P (attack requirements present) metric is significant - it signals that exploitation is conditional on the application actually using the CodeMode toolset's run_code feature with a tool_calls_limit configured, which tempers the PR:N/UI:N 'unauthenticated remote' framing. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is best characterized as no public exploit identified at time of analysis; the Denial Of Service tag reflects the resource/cost-exhaustion nature rather than any evidence of active exploitation. Net: a genuine guardrail-bypass worth patching for teams relying on tool_calls_limit as a cost or safety control, but not an urgent widespread-exploitation emergency. One data note: the input tags omit the prompt-injection/LLM-agent context that the description makes central - verify threat model against your own agent deployment.

An application exposes a pydantic-ai agent with the CodeMode toolset and sets UsageLimits.tool_calls_limit to cap invocations of an expensive or side-effecting tool. An attacker supplies input to the agent (directly, or via prompt-injected content the agent ingests) that causes the sandboxed snippet to call run_nested_call() repeatedly; because these nested calls skip check_before_tool_call, the operator's limit is never enforced and the tool runs well past the intended cap. No public exploit code was identified at time of analysis.