Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pydantic-ai

14 known vulnerabilities (4 high, 8 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 4 high, 8 medium, 2 low
Weekly downloads
1.7M
Dependents
512
Registry
PyPI

Advisories 14

  • `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

    Affected: from 1.34.0, fixed in 1.107.4; from 2.0.0b1, fixed in 2.28.0; from 1.34.0, fixed in 1.107.4; from 2.0.0b1, fixed in 2.28.0.

  • CVE-2026-107294Medium 6.5

    Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

    Affected: from 1.77.0, fixed in 1.107.2; from 2.0.0b1, fixed in 2.24.0; from 1.77.0, fixed in 1.107.2; from 2.0.0b1, fixed in 2.24.0.

  • Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

    Affected: from 0.3.4, fixed in 1.107.4; from 2.0.0b1, fixed in 2.27.1; from 0.3.4, fixed in 1.107.4; from 2.0.0b1, fixed in 2.27.1.

  • CVE-2026-107292Medium 6.4

    Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

    Affected: from 1.34.0, fixed in 1.107.5; from 2.0.0b1, fixed in 2.30.0; from 1.34.0, fixed in 1.107.5; from 2.0.0b1, fixed in 2.30.0.

  • Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

    Affected: from 0.3.4, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 0.3.4, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0.

  • CVE-2026-107290Medium 6.5

    Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

    Affected: from 1.77.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 1.77.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0.

  • CVE-2026-107289Medium 6.8

    Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

    Affected: from 1.56.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 1.56.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0.

  • CVE-2026-107287Medium 6.5

    Pydantic AI: Excessive resource use when local web fetching converts nested HTML

    Affected: from 1.77.0, fixed in 1.107.7; from 2.0.0b1, fixed in 2.52.0; from 1.77.0, fixed in 1.107.7; from 2.0.0b1, fixed in 2.52.0.

  • Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

    Affected: from 2.10.0, fixed in 2.53.0.

  • CVE-2026-54249Medium 6.8

    VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata…

    Affected: from 1.65.0, fixed in 1.106.0; from 2.0.0b1, fixed in 2.0.0b6; from 1.65.0, fixed in 1.106.0; from 2.0.0b1, fixed in 2.0.0b6.

  • CVE-2026-46678Medium 6.8

    Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

    Affected: from 1.56.0, fixed in 1.99.0.

  • CVE-2026-48782Medium 6.8

    pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

    Affected: from 1.56.0, fixed in 1.102.0; from 2.0.0b1, fixed in 2.0.0b3; from 1.56.0, fixed in 1.102.0; from 2.0.0b1, fixed in 2.0.0b3.

  • Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

    Affected: from 0.0.26, fixed in 1.56.0.

  • Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

    Affected: from 1.34.0, fixed in 1.51.0.