Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pydantic-ai-slim

14 known vulnerabilities (4 high, 8 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
2.66.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
2.66.0 (Nov 4, 2026), the latest release
Advisories
14 · 4 high, 8 medium, 2 low
Weekly downloads
8.2M
Dependents
873
Releases
353 since 0.0.6 (Nov 25, 2024)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-107295
    Affects 1.34.0 to 1.107.2 (1.107.4 is outside it); 2.0.0b1 to 2.27.1 (2.28.0 is outside it)
  • CVE-2026-107294
    Affects 1.77.0 to 1.107.1 (1.107.2 is outside it); 2.0.0b1 to 2.23.0 (2.24.0 is outside it)
  • CVE-2026-107293
    Affects 0.3.4 to 1.107.2 (1.107.4 is outside it); 2.0.0b1 to 2.27.0 (2.27.1 is outside it)
  • CVE-2026-107292
    Affects 1.34.0 to 1.107.4 (1.107.5 is outside it); 2.0.0b1 to 2.29.0 (2.30.0 is outside it)
  • CVE-2026-107291
    Affects 0.3.4 to 1.107.5 (1.107.6 is outside it); 2.0.0b1 to 2.43.0 (2.44.0 is outside it)
  • CVE-2026-107290
    Affects 1.77.0 to 1.107.5 (1.107.6 is outside it); 2.0.0b1 to 2.43.0 (2.44.0 is outside it)
  • CVE-2026-107289
    Affects 1.56.0 to 1.107.5 (1.107.6 is outside it); 2.0.0b1 to 2.43.0 (2.44.0 is outside it)
  • CVE-2026-107287
    Affects 1.77.0 to 1.107.6 (1.107.7 is outside it); 2.0.0b1 to 2.51.0 (2.52.0 is outside it)
  • CVE-2026-107286
    Affects 2.10.0 to 2.52.0 (2.53.0 is outside it)
  • CVE-2026-54249
    Affects 1.65.0 to 1.105.0 (1.106.0 is outside it); 2.0.0b1 to 2.0.0b5 (2.0.0b6 is outside it)
  • CVE-2026-46678
    Affects 1.56.0 to 1.98.0 (1.99.0 is outside it)
  • CVE-2026-48782
    Affects 1.56.0 to 1.101.0 (1.102.0 is outside it); 2.0.0b1 to 2.0.0b2 (2.0.0b3 is outside it)
Show all 14 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

    Affected: from 1.34.0, fixed in 1.107.4; from 2.0.0b1, fixed in 2.28.0; from 1.34.0, fixed in 1.107.4; from 2.0.0b1, fixed in 2.28.0.

    Fixed in 1.107.4 (released Aug 12, 2026, 57 days before disclosure) and 2.28.0 (released Aug 12, 2026, 57 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-107294Medium 6.5

    Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

    Affected: from 1.77.0, fixed in 1.107.2; from 2.0.0b1, fixed in 2.24.0; from 1.77.0, fixed in 1.107.2; from 2.0.0b1, fixed in 2.24.0.

    Fixed in 1.107.2 (released Aug 8, 2026, 61 days before disclosure) and 2.24.0 (released Aug 5, 2026, 64 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

    Affected: from 0.3.4, fixed in 1.107.4; from 2.0.0b1, fixed in 2.27.1; from 0.3.4, fixed in 1.107.4; from 2.0.0b1, fixed in 2.27.1.

    Fixed in 1.107.4 (released Aug 12, 2026, 57 days before disclosure) and 2.27.1 (released Aug 11, 2026, 58 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-107292Medium 6.4

    Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

    Affected: from 1.34.0, fixed in 1.107.5; from 2.0.0b1, fixed in 2.30.0; from 1.34.0, fixed in 1.107.5; from 2.0.0b1, fixed in 2.30.0.

    Fixed in 1.107.5 (released Aug 14, 2026, 55 days before disclosure) and 2.30.0 (released Aug 14, 2026, 55 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

    Affected: from 0.3.4, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 0.3.4, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0.

    Fixed in 1.107.6 (released Sep 17, 2026, 21 days before disclosure) and 2.44.0 (released Sep 17, 2026, 21 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-107290Medium 6.5

    Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

    Affected: from 1.77.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 1.77.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0.

    Fixed in 1.107.6 (released Sep 17, 2026, 21 days before disclosure) and 2.44.0 (released Sep 17, 2026, 21 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-107289Medium 6.8

    Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

    Affected: from 1.56.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 1.56.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0.

    Fixed in 1.107.6 (released Sep 17, 2026, 21 days before disclosure) and 2.44.0 (released Sep 17, 2026, 21 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-107287Medium 6.5

    Pydantic AI: Excessive resource use when local web fetching converts nested HTML

    Affected: from 1.77.0, fixed in 1.107.7; from 2.0.0b1, fixed in 2.52.0; from 1.77.0, fixed in 1.107.7; from 2.0.0b1, fixed in 2.52.0.

    Fixed in 1.107.7 (released Sep 30, 2026, 8 days before disclosure) and 2.52.0 (released Sep 30, 2026, 8 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

    Affected: from 2.10.0, fixed in 2.53.0.

    Fixed in 2.53.0 (released Oct 2, 2026, 6 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-54249Medium 6.8

    VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata…

    Affected: from 1.65.0, fixed in 1.106.0; from 2.0.0b1, fixed in 2.0.0b6; from 1.65.0, fixed in 1.106.0; from 2.0.0b1, fixed in 2.0.0b6.

    Fixed in 1.106.0 (released Jun 5, 2026, 54 days before disclosure) and 2.0.0b6 (released Jun 5, 2026, 54 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-46678Medium 6.8

    Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

    Affected: from 1.56.0, fixed in 1.99.0.

    Fixed in 1.99.0 (released May 20, 2026, 70 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • CVE-2026-48782Medium 6.8

    pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

    Affected: from 1.56.0, fixed in 1.102.0; from 2.0.0b1, fixed in 2.0.0b3; from 1.56.0, fixed in 1.102.0; from 2.0.0b1, fixed in 2.0.0b3.

    Fixed in 1.102.0 (released May 23, 2026, 24 days before disclosure) and 2.0.0b3 (released May 23, 2026, 24 days before disclosure).

    The latest release, 2.66.0, is not affected.

  • Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

    Affected: from 0.0.26, fixed in 1.56.0.

    Fixed in 1.56.0 (released Feb 6, 2026, the day of disclosure).

    The latest release, 2.66.0, is not affected.

  • Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

    Affected: from 1.34.0, fixed in 1.51.0.

    Fixed in 1.51.0 (released Jan 31, 2026, 6 days before disclosure).

    The latest release, 2.66.0, is not affected.