Pydantic Ai Slim
Monthly
Pydantic AI's OpenTelemetry instrumentation fails to redact validation-retry prompt content from exported telemetry, so agents configured with InstrumentationSettings(include_content=False) can still leak model-generated invalid values into span attributes such as gen_ai.input.messages and pydantic_ai.all_messages. Only deployments using structured output modes that skip tool calls (NativeOutput or PromptedOutput) or output validators on text output are exposed on this specific code path; tool-call retries and installations that never set include_content=False are unaffected. Disclosure is limited to parties able to read the telemetry backend, and no public exploit code or confirmed active exploitation has been reported; assessed CVSS is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3).
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website visited by a developer reach the loopback-hosted agent as a same-origin service, read the served UI, and submit chat requests that execute the agent's tools with the local process's privileges and credentials - resulting in data disclosure or unwanted side effects. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.34.0 through 1.107.4 on the v1 line and 2.0.0b1 through 2.29.x on the v2 line, and is fixed in 1.107.5 and 2.30.0. Scoring is CVSS 3.1 6.4 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L), reflecting an unauthenticated remote attack path that nevertheless requires the attacker to control a DNS name and persuade a developer to visit the attacker's page in the same browser; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Information disclosure in Pydantic AI's OpenTelemetry instrumentation (vulnerable ranges >= 0.3.4, < 1.107.6 and >= 2.0.0b1, < 2.44.0) lets sensitive agent content reach telemetry backends even when the content-redaction setting InstrumentationSettings(include_content=False) is enabled, because exception events, exception stack traces, error status descriptions, and the serialized model_request_parameters attribute were never covered by that setting. Affected deployments must have OpenTelemetry instrumentation active, must have configured include_content=False, and must actually hit an error path - a tool ModelRetry/ToolFailed, a tool-code exception, a validation error, or a failed model request, embedding, or image-generation call - for the leak to occur; data reaches only parties who already have read access to the configured telemetry backend, so no new access to agent data is granted. There is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed severity is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with vendor-released patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.43.x lets a server-controlled web page stall an entire agent process: the local web_fetch_tool and the WebFetch capability's local fallback perform quadratic-time title extraction, whitespace normalization, preformatted-block stripping, and ordered-list numbering directly on the asyncio event loop, so a modest ~1-2 MB page of repeated unterminated <title> tags, long whitespace runs, or large ordered lists blocks every other coroutine in the process for minutes. A response carrying a Content-Type charset of punycode achieves the same block with no HTML at all (roughly half a minute per megabyte of body), while unsupported codecs such as rot_13 or base64_codec, or HTML/JSON nested a few hundred elements deep, raise an unexpected exception that aborts the individual agent run. Exploitation requires an application that enables the vulnerable tool and a low-privileged actor able to steer the agent into fetching an attacker-controlled URL (typically via untrusted or injected prompts); the pre-existing SSRF protections and download-size cap from GHSA-v2xh-2vp8-57h8 remain effective but only bound bytes downloaded, not processing time. There is no public exploit code identified at time of analysis, and the impact is availability only - no confidentiality or integrity loss.
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL into local-network access reach IPv6 cloud metadata endpoints such as fd00:ec2::254 and read short-lived cloud IAM credentials, because appending an RFC 4007 zone identifier (for example fd00:ec2::254%251) makes the address unequal to its blocklist entry while the kernel silently ignores the zone for a non-link-local destination and routes the request anyway. Affected releases are pydantic-ai and pydantic-ai-slim at 1.56.0 up to but not including 1.107.6, and 2.0.0b1 up to but not including 2.44.0; exploitation additionally requires that the URL be attacker-influenced or model-chosen, that one of the two opt-ins be enabled (FileUrl with force_download='allow-local', or web_fetch_tool(allow_local_urls=True) - both off by default), and an IPv6-enabled environment with a reachable metadata service. Vendor-released patches are available in versions 1.107.6 and 2.44.0 (upstream fix tracked via pull requests 8401 and 8402); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets an attacker-influenced model reach a host the operator explicitly placed in blocked_domains by supplying a DNS-equivalent spelling - an IDNA/fullwidth form, a non-ASCII label separator, a case variation, or a trailing root label - that does not string-match the configured entry but resolves to the same host. Affected are pydantic-ai and pydantic-ai-slim versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.44.0; the flaw is a denylist bypass only, so configurations that use allowed_domains fail closed and are unaffected, and the private-IP and cloud-metadata SSRF protections remain effective, meaning internal or metadata endpoints are not reachable through this bug. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) as a low-severity, high-complexity information-fetch issue, with no public exploit identified at time of analysis and vendor patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML page, fetched on the model's behalf, to burn excessive CPU and memory during HTML-to-Markdown conversion (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CWE-400). Affected are pydantic-ai and pydantic-ai-slim from 1.77.0 through 1.107.6, and from 2.0.0b1 through 2.51.x (fixed in 1.107.7 and 2.52.0); provider-native web fetching is not affected, and no public exploit code has been identified at time of analysis, with no KEV listing. Because the fetch must be induced through the agent (UI:R), the realistic exposure is a stalled or resource-starved agent process rather than a remotely triggerable crash, and EPSS-style urgency is correspondingly moderate.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default `force_download='allow-local'` mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.
Pydantic AI's OpenTelemetry instrumentation fails to redact validation-retry prompt content from exported telemetry, so agents configured with InstrumentationSettings(include_content=False) can still leak model-generated invalid values into span attributes such as gen_ai.input.messages and pydantic_ai.all_messages. Only deployments using structured output modes that skip tool calls (NativeOutput or PromptedOutput) or output validators on text output are exposed on this specific code path; tool-call retries and installations that never set include_content=False are unaffected. Disclosure is limited to parties able to read the telemetry backend, and no public exploit code or confirmed active exploitation has been reported; assessed CVSS is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3).
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website visited by a developer reach the loopback-hosted agent as a same-origin service, read the served UI, and submit chat requests that execute the agent's tools with the local process's privileges and credentials - resulting in data disclosure or unwanted side effects. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.34.0 through 1.107.4 on the v1 line and 2.0.0b1 through 2.29.x on the v2 line, and is fixed in 1.107.5 and 2.30.0. Scoring is CVSS 3.1 6.4 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L), reflecting an unauthenticated remote attack path that nevertheless requires the attacker to control a DNS name and persuade a developer to visit the attacker's page in the same browser; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Information disclosure in Pydantic AI's OpenTelemetry instrumentation (vulnerable ranges >= 0.3.4, < 1.107.6 and >= 2.0.0b1, < 2.44.0) lets sensitive agent content reach telemetry backends even when the content-redaction setting InstrumentationSettings(include_content=False) is enabled, because exception events, exception stack traces, error status descriptions, and the serialized model_request_parameters attribute were never covered by that setting. Affected deployments must have OpenTelemetry instrumentation active, must have configured include_content=False, and must actually hit an error path - a tool ModelRetry/ToolFailed, a tool-code exception, a validation error, or a failed model request, embedding, or image-generation call - for the leak to occur; data reaches only parties who already have read access to the configured telemetry backend, so no new access to agent data is granted. There is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed severity is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with vendor-released patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.43.x lets a server-controlled web page stall an entire agent process: the local web_fetch_tool and the WebFetch capability's local fallback perform quadratic-time title extraction, whitespace normalization, preformatted-block stripping, and ordered-list numbering directly on the asyncio event loop, so a modest ~1-2 MB page of repeated unterminated <title> tags, long whitespace runs, or large ordered lists blocks every other coroutine in the process for minutes. A response carrying a Content-Type charset of punycode achieves the same block with no HTML at all (roughly half a minute per megabyte of body), while unsupported codecs such as rot_13 or base64_codec, or HTML/JSON nested a few hundred elements deep, raise an unexpected exception that aborts the individual agent run. Exploitation requires an application that enables the vulnerable tool and a low-privileged actor able to steer the agent into fetching an attacker-controlled URL (typically via untrusted or injected prompts); the pre-existing SSRF protections and download-size cap from GHSA-v2xh-2vp8-57h8 remain effective but only bound bytes downloaded, not processing time. There is no public exploit code identified at time of analysis, and the impact is availability only - no confidentiality or integrity loss.
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL into local-network access reach IPv6 cloud metadata endpoints such as fd00:ec2::254 and read short-lived cloud IAM credentials, because appending an RFC 4007 zone identifier (for example fd00:ec2::254%251) makes the address unequal to its blocklist entry while the kernel silently ignores the zone for a non-link-local destination and routes the request anyway. Affected releases are pydantic-ai and pydantic-ai-slim at 1.56.0 up to but not including 1.107.6, and 2.0.0b1 up to but not including 2.44.0; exploitation additionally requires that the URL be attacker-influenced or model-chosen, that one of the two opt-ins be enabled (FileUrl with force_download='allow-local', or web_fetch_tool(allow_local_urls=True) - both off by default), and an IPv6-enabled environment with a reachable metadata service. Vendor-released patches are available in versions 1.107.6 and 2.44.0 (upstream fix tracked via pull requests 8401 and 8402); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets an attacker-influenced model reach a host the operator explicitly placed in blocked_domains by supplying a DNS-equivalent spelling - an IDNA/fullwidth form, a non-ASCII label separator, a case variation, or a trailing root label - that does not string-match the configured entry but resolves to the same host. Affected are pydantic-ai and pydantic-ai-slim versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.44.0; the flaw is a denylist bypass only, so configurations that use allowed_domains fail closed and are unaffected, and the private-IP and cloud-metadata SSRF protections remain effective, meaning internal or metadata endpoints are not reachable through this bug. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) as a low-severity, high-complexity information-fetch issue, with no public exploit identified at time of analysis and vendor patches available in 1.107.6 and 2.44.0.
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML page, fetched on the model's behalf, to burn excessive CPU and memory during HTML-to-Markdown conversion (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CWE-400). Affected are pydantic-ai and pydantic-ai-slim from 1.77.0 through 1.107.6, and from 2.0.0b1 through 2.51.x (fixed in 1.107.7 and 2.52.0); provider-native web fetching is not affected, and no public exploit code has been identified at time of analysis, with no KEV listing. Because the fetch must be induced through the agent (UI:R), the realistic exposure is a stalled or resource-starved agent process rather than a remotely triggerable crash, and EPSS-style urgency is correspondingly moderate.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default `force_download='allow-local'` mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.