EUVD-2026-50555Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable with no authentication under default adapter config; impact bounded to low C/I since tool registry scope limits blast radius and no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before_model_request / after_model_request), since a forged call skips the model turn and bypasses that guardrail; approval-gated tools (requires_approval=True) are not auto-executed by this path. This issue has been fixed in versions 1.107.1 and 2.5.0.
AnalysisAI
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Technical ContextAI
Pydantic AI (CPE: cpe:2.3:a:pydantic:pydantic-ai:*:*:*:*:*:*:*:* and cpe:2.3:a:pydantic:pydantic-ai-slim:*:*:*:*:*:*:*:*) is a Python agent framework that wires LLM models to typed tool registries. Its AG-UI and Vercel AI adapters accept untrusted message histories from browser or streaming clients and are designed to scrub 'dangling' (unresolved, client-fabricated) tool calls via the sanitize_messages routine before forwarding history to the agent. The root cause is CWE-863 (Incorrect Authorization): the index used to anchor the sanitization pass was computed from the original message list length before any messages were dropped. When the default manage_system_prompt='server' policy caused a trailing client-submitted system message to be discarded during sanitization, the list shrank by one, and the preceding assistant message carrying an unresolved tool call became the new tail - at an index the sanitizer had already passed. The framework then dispatched that tool call as legitimate model output, skipping authorization checks entirely. Approval-gated tools (requires_approval=True) are handled by a separate pathway and are not affected.
RemediationAI
The primary fix is to upgrade pydantic-ai or pydantic-ai-slim to version 1.107.1 (v1 branch) or 2.5.0 (v2 branch), as confirmed by the vendor advisory at https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9. If an immediate upgrade is not possible, annotate every registered tool that performs sensitive or state-modifying actions with requires_approval=True - this prevents auto-dispatch via the vulnerable path, though it adds user-interaction friction to the approval workflow. Alternatively, applications can temporarily avoid the AG-UI and Vercel AI adapters entirely and interact with the agent through the standard programmatic API, which is not affected by this sanitization flaw. Do not rely on model-request hooks (before_model_request / after_model_request) as a sole authorization control in affected versions, as forged tool calls bypass those hooks.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today