Pydantic Ai
CVE-2026-25640
MEDIUM
GHSA-wjp5-868j-wqv7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with path traversal in version parameter
-
ExploitSend URL to victim
-
ExecutionBrowser loads attacker-controlled JavaScript
-
ImpactExecute arbitrary code in application context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Pydantic AI web UI versions 1.34.0 to before 1.51.0 with unvalidated CDN URL construction via version query parameter. Victim must click crafted URL. Requires access to same CDN infrastructure. |
| Impact | CVSS 7.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to serve arbitrary JavaScript in the context of the application by crafting a malic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthenticated attackers to inject arbitrary JavaScript by manipulating the CDN version parameter in a malicious URL. When a victim visits the crafted link, attacker-controlled code executes in their browser, enabling theft of chat history and other sensitive client-side data. No patch is currently available.
Earlier versions of this analysis (1)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. [CVSS 7.1 HIGH]
RemediationAI
Fixed in version 1.51.0.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects Pydantic Ai. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch
Know when Pydantic Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data. This vulnerability only affects applications that use Agent.to_web to serve a chat interface and clai web to serve a chat interface from the CLI. These are typically run locally (on localhost), but may also be deployed on a remote server. This vulnerability is fixed in 1.51.0.
Blast Radius
ecosystem impact- 1 pypi packages depend on pydantic-ai (1 direct, 0 indirect)
- 4 pypi packages depend on pydantic-ai-slim (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.34.0 and other introduced versions.
Executive ViewAI
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that could allow attackers to inject malicious JavaScript and compromise user sessions or steal sensitive data. Organizations using affected versions of this Python framework in production environments face immediate risk of account takeover and data exfiltration through specially crafted URLs.
Since no patch is currently available, implement: (1) WAF rules to block requests containing path traversal patterns (../, ..\) in the Pydantic AI web UI URL parameters; (2) Network segmentation to restrict web UI access to trusted internal networks only; (3) Disable the web UI feature entirely if not operationally required; (4) Implement strict Content Security Policy (CSP) headers to prevent inline script execution; (5) Monitor access logs for suspicious URL patterns and JavaScript injection attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)NVD
More in Pydantic Ai
View allPydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functiona
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit whil
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots i
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network at
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL int
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unaut
Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML p
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdap
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets
Exploit-DB