Pydantic AI CVE-2026-65975

Exploitation requires that the target application uses one of the two affected UI adapters: the AG-UI adapter (instantiated via Agent.to_ag_ui() or AGUIAdapter) or the Vercel AI adapter (VercelAIAdapter). The triggering condition is the combination of a client-submitted system message trailing the message history (which is dropped under the default manage_system_prompt='server' setting) and a preceding assistant message containing an unresolved tool call. This default configuration is what most deployments will have, making the attack surface broadly applicable within the affected population. Exploitation is blocked if the targeted tool has requires_approval=True, since approval-gated tools are not dispatched by the auto-execute path. Applications that do not expose any UI adapter endpoint (using only the programmatic agent API) are entirely unaffected regardless of version.

The NVD CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N correctly captures that this is a network-reachable, zero-prerequisite attack with bounded impact. The CVSS score of 6.5 is reasonable: the actual blast radius is constrained by which registered tools the application exposes and what those tools can do - a deployment with only read-only or low-privilege tools faces limited real-world impact, while one exposing tools that modify data, call external APIs, or interact with infrastructure faces meaningfully higher risk. The most critical exploitation scenario targets applications that rely on before_model_request or after_model_request hooks as an authorization or content-filtering guardrail, since forged tool calls skip the model turn entirely and therefore bypass those hooks. No EPSS score was provided in the input data and no KEV listing exists, suggesting no confirmed widespread exploitation. The attack requires no special conditions against any application using the affected UI adapters under default configuration, making this a genuine medium-priority item for the affected population, despite the moderate base score.

An attacker interacting with an application that exposes the AG-UI or Vercel AI streaming endpoint crafts a message history that includes an assistant-turn message with an unresolved tool call followed by a client system message. Under the default manage_system_prompt='server' policy, sanitize_messages drops the trailing system message, causing the off-by-one index error that leaves the dangling tool call uninspected at the new tail. The framework dispatches the tool with the attacker's chosen arguments - for example, calling a data-export or API-interaction tool with attacker-controlled parameters - without the model ever having produced that call. No public proof-of-concept code has been identified at time of analysis.