Pydantic Ai
Monthly
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit while `Agent.to_web()` or `clai web` is running to fire forged chat requests at the loopback-hosted server, causing the served agent to start a run and execute its tools with the privileges and credentials of the local process. The pre-patch `/api/chat` endpoint performed no Content-Type validation, so a malicious page can deliver a JSON body cross-origin using a CORS-safelisted content type (text/plain, multipart/form-data, application/x-www-form-urlencoded, or none at all) without triggering a preflight; binding the server to localhost - the default - provides no protection because a browser page can reach 127.0.0.1. Realized damage is bounded by the tools the agent exposes, and `requires_approval=True` does not help because the endpoint trusts approval decisions relayed by the client; exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, 7.6) but requires the developer to browse an attacker-controlled page while the dev UI is running, and there is no public exploit code identified at time of analysis. Vendor-released patches are available in 1.107.4 and 2.28.0.
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots in a shared ConcurrencyLimiter, progressively starving later requests until a service that reuses one long-lived limiter can no longer make model calls - an availability-only denial of service (C:N/I:N/A:H) with no confidentiality or integrity impact. The issue is remotely reachable and unauthenticated (PR:N), but our independent assessment rates it AC:H rather than GitHub's AC:L because exploitation requires a specific deployment pattern: model requests wrapped in ConcurrencyLimitedModel (or covered by limit_model_concurrency) that share a single long-lived limiter across streamed responses; agent-level max_concurrency and all non-streaming model requests are explicitly unaffected, and a short-lived or per-request limiter never accumulates enough leaked slots to deadlock. Slots are leaked by early stream termination, cancellation, consumer exceptions, or even full stream_text() consumption with debounce_by=0.1, and the vendor-released fix in 2.53.0 is available; no public exploit code identified at time of analysis.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying any size limit in its remote-content download paths, so an attacker-chosen URL can stream an arbitrarily large body that exhausts process memory and crashes the worker. Affected components are the local web_fetch_tool, the WebFetch capability's local fallback, and remote FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl); the issue affects versions from 1.77.0 to before 1.107.2 on the v1 line and 2.0.0b1 through 2.23.0 on the v2 line. This is an availability-only flaw (CWE-400) - SSRF protections remain effective and there is no confidentiality or integrity impact - and no public exploit identified at time of analysis, though exploitation requires only that the application register the local web-fetch tool and expose the agent to untrusted prompts (or download untrusted-input-influenced FileUrls) while running an affected version.
Pydantic AI's OpenTelemetry instrumentation fails to redact validation-retry prompt content from exported telemetry, so agents configured with InstrumentationSettings(include_content=False) can still leak model-generated invalid values into span attributes such as gen_ai.input.messages and pydantic_ai.all_messages. Only deployments using structured output modes that skip tool calls (NativeOutput or PromptedOutput) or output validators on text output are exposed on this specific code path; tool-call retries and installations that never set include_content=False are unaffected. Disclosure is limited to parties able to read the telemetry backend, and no public exploit code or confirmed active exploitation has been reported; assessed CVSS is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3).
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website visited by a developer reach the loopback-hosted agent as a same-origin service, read the served UI, and submit chat requests that execute the agent's tools with the local process's privileges and credentials - resulting in data disclosure or unwanted side effects. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.34.0 through 1.107.4 on the v1 line and 2.0.0b1 through 2.29.x on the v2 line, and is fixed in 1.107.5 and 2.30.0. Scoring is CVSS 3.1 6.4 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L), reflecting an unauthenticated remote attack path that nevertheless requires the attacker to control a DNS name and persuade a developer to visit the attacker's page in the same browser; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Information disclosure in Pydantic AI's OpenTelemetry instrumentation (vulnerable ranges >= 0.3.4, < 1.107.6 and >= 2.0.0b1, < 2.44.0) lets sensitive agent content reach telemetry backends even when the content-redaction setting InstrumentationSettings(include_content=False) is enabled, because exception events, exception stack traces, error status descriptions, and the serialized model_request_parameters attribute were never covered by that setting. Affected deployments must have OpenTelemetry instrumentation active, must have configured include_content=False, and must actually hit an error path - a tool ModelRetry/ToolFailed, a tool-code exception, a validation error, or a failed model request, embedding, or image-generation call - for the leak to occur; data reaches only parties who already have read access to the configured telemetry backend, so no new access to agent data is granted. There is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed severity is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with vendor-released patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.43.x lets a server-controlled web page stall an entire agent process: the local web_fetch_tool and the WebFetch capability's local fallback perform quadratic-time title extraction, whitespace normalization, preformatted-block stripping, and ordered-list numbering directly on the asyncio event loop, so a modest ~1-2 MB page of repeated unterminated <title> tags, long whitespace runs, or large ordered lists blocks every other coroutine in the process for minutes. A response carrying a Content-Type charset of punycode achieves the same block with no HTML at all (roughly half a minute per megabyte of body), while unsupported codecs such as rot_13 or base64_codec, or HTML/JSON nested a few hundred elements deep, raise an unexpected exception that aborts the individual agent run. Exploitation requires an application that enables the vulnerable tool and a low-privileged actor able to steer the agent into fetching an attacker-controlled URL (typically via untrusted or injected prompts); the pre-existing SSRF protections and download-size cap from GHSA-v2xh-2vp8-57h8 remain effective but only bound bytes downloaded, not processing time. There is no public exploit code identified at time of analysis, and the impact is availability only - no confidentiality or integrity loss.
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL into local-network access reach IPv6 cloud metadata endpoints such as fd00:ec2::254 and read short-lived cloud IAM credentials, because appending an RFC 4007 zone identifier (for example fd00:ec2::254%251) makes the address unequal to its blocklist entry while the kernel silently ignores the zone for a non-link-local destination and routes the request anyway. Affected releases are pydantic-ai and pydantic-ai-slim at 1.56.0 up to but not including 1.107.6, and 2.0.0b1 up to but not including 2.44.0; exploitation additionally requires that the URL be attacker-influenced or model-chosen, that one of the two opt-ins be enabled (FileUrl with force_download='allow-local', or web_fetch_tool(allow_local_urls=True) - both off by default), and an IPv6-enabled environment with a reachable metadata service. Vendor-released patches are available in versions 1.107.6 and 2.44.0 (upstream fix tracked via pull requests 8401 and 8402); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets an attacker-influenced model reach a host the operator explicitly placed in blocked_domains by supplying a DNS-equivalent spelling - an IDNA/fullwidth form, a non-ASCII label separator, a case variation, or a trailing root label - that does not string-match the configured entry but resolves to the same host. Affected are pydantic-ai and pydantic-ai-slim versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.44.0; the flaw is a denylist bypass only, so configurations that use allowed_domains fail closed and are unaffected, and the private-IP and cloud-metadata SSRF protections remain effective, meaning internal or metadata endpoints are not reachable through this bug. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) as a low-severity, high-complexity information-fetch issue, with no public exploit identified at time of analysis and vendor patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML page, fetched on the model's behalf, to burn excessive CPU and memory during HTML-to-Markdown conversion (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CWE-400). Affected are pydantic-ai and pydantic-ai-slim from 1.77.0 through 1.107.6, and from 2.0.0b1 through 2.51.x (fixed in 1.107.7 and 2.52.0); provider-native web fetching is not affected, and no public exploit code has been identified at time of analysis, with no KEV listing. Because the fetch must be induced through the agent (UI:R), the realistic exposure is a stalled or resource-starved agent process rather than a remotely triggerable crash, and EPSS-style urgency is correspondingly moderate.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default `force_download='allow-local'` mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthenticated attackers to inject arbitrary JavaScript by manipulating the CDN version parameter in a malicious URL. When a victim visits the crafted link, attacker-controlled code executes in their browser, enabling theft of chat history and other sensitive client-side data. No patch is currently available.
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit while `Agent.to_web()` or `clai web` is running to fire forged chat requests at the loopback-hosted server, causing the served agent to start a run and execute its tools with the privileges and credentials of the local process. The pre-patch `/api/chat` endpoint performed no Content-Type validation, so a malicious page can deliver a JSON body cross-origin using a CORS-safelisted content type (text/plain, multipart/form-data, application/x-www-form-urlencoded, or none at all) without triggering a preflight; binding the server to localhost - the default - provides no protection because a browser page can reach 127.0.0.1. Realized damage is bounded by the tools the agent exposes, and `requires_approval=True` does not help because the endpoint trusts approval decisions relayed by the client; exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, 7.6) but requires the developer to browse an attacker-controlled page while the dev UI is running, and there is no public exploit code identified at time of analysis. Vendor-released patches are available in 1.107.4 and 2.28.0.
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots in a shared ConcurrencyLimiter, progressively starving later requests until a service that reuses one long-lived limiter can no longer make model calls - an availability-only denial of service (C:N/I:N/A:H) with no confidentiality or integrity impact. The issue is remotely reachable and unauthenticated (PR:N), but our independent assessment rates it AC:H rather than GitHub's AC:L because exploitation requires a specific deployment pattern: model requests wrapped in ConcurrencyLimitedModel (or covered by limit_model_concurrency) that share a single long-lived limiter across streamed responses; agent-level max_concurrency and all non-streaming model requests are explicitly unaffected, and a short-lived or per-request limiter never accumulates enough leaked slots to deadlock. Slots are leaked by early stream termination, cancellation, consumer exceptions, or even full stream_text() consumption with debounce_by=0.1, and the vendor-released fix in 2.53.0 is available; no public exploit code identified at time of analysis.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying any size limit in its remote-content download paths, so an attacker-chosen URL can stream an arbitrarily large body that exhausts process memory and crashes the worker. Affected components are the local web_fetch_tool, the WebFetch capability's local fallback, and remote FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl); the issue affects versions from 1.77.0 to before 1.107.2 on the v1 line and 2.0.0b1 through 2.23.0 on the v2 line. This is an availability-only flaw (CWE-400) - SSRF protections remain effective and there is no confidentiality or integrity impact - and no public exploit identified at time of analysis, though exploitation requires only that the application register the local web-fetch tool and expose the agent to untrusted prompts (or download untrusted-input-influenced FileUrls) while running an affected version.
Pydantic AI's OpenTelemetry instrumentation fails to redact validation-retry prompt content from exported telemetry, so agents configured with InstrumentationSettings(include_content=False) can still leak model-generated invalid values into span attributes such as gen_ai.input.messages and pydantic_ai.all_messages. Only deployments using structured output modes that skip tool calls (NativeOutput or PromptedOutput) or output validators on text output are exposed on this specific code path; tool-call retries and installations that never set include_content=False are unaffected. Disclosure is limited to parties able to read the telemetry backend, and no public exploit code or confirmed active exploitation has been reported; assessed CVSS is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3).
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website visited by a developer reach the loopback-hosted agent as a same-origin service, read the served UI, and submit chat requests that execute the agent's tools with the local process's privileges and credentials - resulting in data disclosure or unwanted side effects. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.34.0 through 1.107.4 on the v1 line and 2.0.0b1 through 2.29.x on the v2 line, and is fixed in 1.107.5 and 2.30.0. Scoring is CVSS 3.1 6.4 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L), reflecting an unauthenticated remote attack path that nevertheless requires the attacker to control a DNS name and persuade a developer to visit the attacker's page in the same browser; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Information disclosure in Pydantic AI's OpenTelemetry instrumentation (vulnerable ranges >= 0.3.4, < 1.107.6 and >= 2.0.0b1, < 2.44.0) lets sensitive agent content reach telemetry backends even when the content-redaction setting InstrumentationSettings(include_content=False) is enabled, because exception events, exception stack traces, error status descriptions, and the serialized model_request_parameters attribute were never covered by that setting. Affected deployments must have OpenTelemetry instrumentation active, must have configured include_content=False, and must actually hit an error path - a tool ModelRetry/ToolFailed, a tool-code exception, a validation error, or a failed model request, embedding, or image-generation call - for the leak to occur; data reaches only parties who already have read access to the configured telemetry backend, so no new access to agent data is granted. There is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed severity is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with vendor-released patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.43.x lets a server-controlled web page stall an entire agent process: the local web_fetch_tool and the WebFetch capability's local fallback perform quadratic-time title extraction, whitespace normalization, preformatted-block stripping, and ordered-list numbering directly on the asyncio event loop, so a modest ~1-2 MB page of repeated unterminated <title> tags, long whitespace runs, or large ordered lists blocks every other coroutine in the process for minutes. A response carrying a Content-Type charset of punycode achieves the same block with no HTML at all (roughly half a minute per megabyte of body), while unsupported codecs such as rot_13 or base64_codec, or HTML/JSON nested a few hundred elements deep, raise an unexpected exception that aborts the individual agent run. Exploitation requires an application that enables the vulnerable tool and a low-privileged actor able to steer the agent into fetching an attacker-controlled URL (typically via untrusted or injected prompts); the pre-existing SSRF protections and download-size cap from GHSA-v2xh-2vp8-57h8 remain effective but only bound bytes downloaded, not processing time. There is no public exploit code identified at time of analysis, and the impact is availability only - no confidentiality or integrity loss.
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL into local-network access reach IPv6 cloud metadata endpoints such as fd00:ec2::254 and read short-lived cloud IAM credentials, because appending an RFC 4007 zone identifier (for example fd00:ec2::254%251) makes the address unequal to its blocklist entry while the kernel silently ignores the zone for a non-link-local destination and routes the request anyway. Affected releases are pydantic-ai and pydantic-ai-slim at 1.56.0 up to but not including 1.107.6, and 2.0.0b1 up to but not including 2.44.0; exploitation additionally requires that the URL be attacker-influenced or model-chosen, that one of the two opt-ins be enabled (FileUrl with force_download='allow-local', or web_fetch_tool(allow_local_urls=True) - both off by default), and an IPv6-enabled environment with a reachable metadata service. Vendor-released patches are available in versions 1.107.6 and 2.44.0 (upstream fix tracked via pull requests 8401 and 8402); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets an attacker-influenced model reach a host the operator explicitly placed in blocked_domains by supplying a DNS-equivalent spelling - an IDNA/fullwidth form, a non-ASCII label separator, a case variation, or a trailing root label - that does not string-match the configured entry but resolves to the same host. Affected are pydantic-ai and pydantic-ai-slim versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.44.0; the flaw is a denylist bypass only, so configurations that use allowed_domains fail closed and are unaffected, and the private-IP and cloud-metadata SSRF protections remain effective, meaning internal or metadata endpoints are not reachable through this bug. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) as a low-severity, high-complexity information-fetch issue, with no public exploit identified at time of analysis and vendor patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML page, fetched on the model's behalf, to burn excessive CPU and memory during HTML-to-Markdown conversion (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CWE-400). Affected are pydantic-ai and pydantic-ai-slim from 1.77.0 through 1.107.6, and from 2.0.0b1 through 2.51.x (fixed in 1.107.7 and 2.52.0); provider-native web fetching is not affected, and no public exploit code has been identified at time of analysis, with no KEV listing. Because the fetch must be induced through the agent (UI:R), the realistic exposure is a stalled or resource-starved agent process rather than a remotely triggerable crash, and EPSS-style urgency is correspondingly moderate.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default `force_download='allow-local'` mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthenticated attackers to inject arbitrary JavaScript by manipulating the CDN version parameter in a malicious URL. When a victim visits the crafted link, attacker-controlled code executes in their browser, enabling theft of chat history and other sensitive client-side data. No patch is currently available.