Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-107295GHSA-H4XC-3QFQ-JF93PYSEC-2026-4278PYSEC-2026-4287

`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 1.107.4, 2.28.0
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • pydantic pydantic-ai

    From 1.34.0 · fixed in 1.107.4; From 2.0.0b1 · fixed in 2.28.0

  • pydantic pydantic-ai-slim

    From 1.34.0 · fixed in 1.107.4; From 2.0.0b1 · fixed in 2.28.0

  • pydantic-aiPyPI

    From 1.34.0 · fixed in 1.107.4

  • pydantic-aiPyPI

    From 2.0.0b1 · fixed in 2.28.0

  • pydantic-ai-slimPyPI

    From 1.34.0 · fixed in 1.107.4

  • pydantic-ai-slimPyPI

    From 2.0.0b1 · fixed in 2.28.0

  • pydantic-aiPyPI

    From 1.34.0 · fixed in 1.107.4; From 2.0.0b1 · fixed in 2.28.0

  • pydantic-ai-slimPyPI

    From 1.34.0 · fixed in 1.107.4; From 2.0.0b1 · fixed in 2.28.0

References 7

GitHub · pydantic/pydantic-ai