# pydantic-ai-slim (PyPI) vulnerabilities 14 known vulnerabilities (4 high, 8 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.66.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 2.66.0 (Nov 4, 2026), the latest release - Weekly downloads: 8.2M - Dependents: 873 - Releases: 353 since 0.0.6 (Nov 25, 2024) - Registry: https://pypi.org/project/pydantic-ai-slim/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107295: 1.34.0 to 1.107.2 (1.107.4 is outside it); 2.0.0b1 to 2.27.1 (2.28.0 is outside it) - CVE-2026-107294: 1.77.0 to 1.107.1 (1.107.2 is outside it); 2.0.0b1 to 2.23.0 (2.24.0 is outside it) - CVE-2026-107293: 0.3.4 to 1.107.2 (1.107.4 is outside it); 2.0.0b1 to 2.27.0 (2.27.1 is outside it) - CVE-2026-107292: 1.34.0 to 1.107.4 (1.107.5 is outside it); 2.0.0b1 to 2.29.0 (2.30.0 is outside it) - CVE-2026-107291: 0.3.4 to 1.107.5 (1.107.6 is outside it); 2.0.0b1 to 2.43.0 (2.44.0 is outside it) - CVE-2026-107290: 1.77.0 to 1.107.5 (1.107.6 is outside it); 2.0.0b1 to 2.43.0 (2.44.0 is outside it) - CVE-2026-107289: 1.56.0 to 1.107.5 (1.107.6 is outside it); 2.0.0b1 to 2.43.0 (2.44.0 is outside it) - CVE-2026-107287: 1.77.0 to 1.107.6 (1.107.7 is outside it); 2.0.0b1 to 2.51.0 (2.52.0 is outside it) - CVE-2026-107286: 2.10.0 to 2.52.0 (2.53.0 is outside it) - CVE-2026-54249: 1.65.0 to 1.105.0 (1.106.0 is outside it); 2.0.0b1 to 2.0.0b5 (2.0.0b6 is outside it) - CVE-2026-46678: 1.56.0 to 1.98.0 (1.99.0 is outside it) - CVE-2026-48782: 1.56.0 to 1.101.0 (1.102.0 is outside it); 2.0.0b1 to 2.0.0b2 (2.0.0b3 is outside it) - CVE-2026-25580: 0.0.26 to 1.55.0 (1.56.0 is outside it) - CVE-2026-25640: 1.34.0 to 1.50.0 (1.51.0 is outside it) ## Advisories (14) ### [CVE-2026-107295](https://cve.now/CVE-2026-107295): \`pydantic-ai-slim\` web UI \`/api/chat\` accepts browser-simple cross-origin requests that can trigger agent tool execution - Severity: High 7.6 - Published: Oct 8, 2026 - Affected: from 1.34.0, fixed in 1.107.4; from 2.0.0b1, fixed in 2.28.0; from 1.34.0, fixed in 1.107.4; from 2.0.0b1, fixed in 2.28.0. - Fixed in 1.107.4 (released Aug 12, 2026, 57 days before disclosure) and 2.28.0 (released Aug 12, 2026, 57 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107294](https://cve.now/CVE-2026-107294): Pydantic AI: Unbounded memory use when downloading remote content via web\_fetch or FileUrl - Severity: Medium 6.5 - Published: Oct 8, 2026 - Affected: from 1.77.0, fixed in 1.107.2; from 2.0.0b1, fixed in 2.24.0; from 1.77.0, fixed in 1.107.2; from 2.0.0b1, fixed in 2.24.0. - Fixed in 1.107.2 (released Aug 8, 2026, 61 days before disclosure) and 2.24.0 (released Aug 5, 2026, 64 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107293](https://cve.now/CVE-2026-107293): Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when \`include\_content=False\` - Severity: Low 2.3 - Published: Oct 8, 2026 - Affected: from 0.3.4, fixed in 1.107.4; from 2.0.0b1, fixed in 2.27.1; from 0.3.4, fixed in 1.107.4; from 2.0.0b1, fixed in 2.27.1. - Fixed in 1.107.4 (released Aug 12, 2026, 57 days before disclosure) and 2.27.1 (released Aug 11, 2026, 58 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107292](https://cve.now/CVE-2026-107292): Pydantic AI Web chat UI (\`Agent.to\_web()\`, \`clai web\`): the local chat endpoint does not validate the \`Host\` header - Severity: Medium 6.4 - Published: Oct 8, 2026 - Affected: from 1.34.0, fixed in 1.107.5; from 2.0.0b1, fixed in 2.30.0; from 1.34.0, fixed in 1.107.5; from 2.0.0b1, fixed in 2.30.0. - Fixed in 1.107.5 (released Aug 14, 2026, 55 days before disclosure) and 2.30.0 (released Aug 14, 2026, 55 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107291](https://cve.now/CVE-2026-107291): Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when \`include\_content=False\` - Severity: Low 2.3 - Published: Oct 8, 2026 - Affected: from 0.3.4, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 0.3.4, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0. - Fixed in 1.107.6 (released Sep 17, 2026, 21 days before disclosure) and 2.44.0 (released Sep 17, 2026, 21 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107290](https://cve.now/CVE-2026-107290): Pydantic AI: Event loop blocked by quadratic title extraction in \`web\_fetch\` - Severity: Medium 6.5 - Published: Oct 8, 2026 - Affected: from 1.77.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 1.77.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0. - Fixed in 1.107.6 (released Sep 17, 2026, 21 days before disclosure) and 2.44.0 (released Sep 17, 2026, 21 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107289](https://cve.now/CVE-2026-107289): Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782) - Severity: Medium 6.8 - Published: Oct 8, 2026 - Affected: from 1.56.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0; from 1.56.0, fixed in 1.107.6; from 2.0.0b1, fixed in 2.44.0. - Fixed in 1.107.6 (released Sep 17, 2026, 21 days before disclosure) and 2.44.0 (released Sep 17, 2026, 21 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107287](https://cve.now/CVE-2026-107287): Pydantic AI: Excessive resource use when local web fetching converts nested HTML - Severity: Medium 6.5 - Published: Oct 8, 2026 - Affected: from 1.77.0, fixed in 1.107.7; from 2.0.0b1, fixed in 2.52.0; from 1.77.0, fixed in 1.107.7; from 2.0.0b1, fixed in 2.52.0. - Fixed in 1.107.7 (released Sep 30, 2026, 8 days before disclosure) and 2.52.0 (released Sep 30, 2026, 8 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-107286](https://cve.now/CVE-2026-107286): Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: from 2.10.0, fixed in 2.53.0. - Fixed in 2.53.0 (released Oct 2, 2026, 6 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-54249](https://cve.now/CVE-2026-54249): VercelAIAdapter trusts client-controlled \`providerMetadata\` to construct \`UploadedFile\` — S3/GCS confused deputy via provider metadata… - Severity: Medium 6.8 - Published: Jul 29, 2026 - Affected: from 1.65.0, fixed in 1.106.0; from 2.0.0b1, fixed in 2.0.0b6; from 1.65.0, fixed in 1.106.0; from 2.0.0b1, fixed in 2.0.0b6. - Fixed in 1.106.0 (released Jun 5, 2026, 54 days before disclosure) and 2.0.0b6 (released Jun 5, 2026, 54 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-46678](https://cve.now/CVE-2026-46678): Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580) - Severity: Medium 6.8 - Published: Jul 29, 2026 - Affected: from 1.56.0, fixed in 1.99.0. - Fixed in 1.99.0 (released May 20, 2026, 70 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-48782](https://cve.now/CVE-2026-48782): pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678) - Severity: Medium 6.8 - Published: Jun 16, 2026 - Affected: from 1.56.0, fixed in 1.102.0; from 2.0.0b1, fixed in 2.0.0b3; from 1.56.0, fixed in 1.102.0; from 2.0.0b1, fixed in 2.0.0b3. - Fixed in 1.102.0 (released May 23, 2026, 24 days before disclosure) and 2.0.0b3 (released May 23, 2026, 24 days before disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-25580](https://cve.now/CVE-2026-25580): Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling - Severity: High 8.6 - Published: Feb 6, 2026 - Affected: from 0.0.26, fixed in 1.56.0. - Fixed in 1.56.0 (released Feb 6, 2026, the day of disclosure). - The latest release, 2.66.0, is not affected. ### [CVE-2026-25640](https://cve.now/CVE-2026-25640): Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL - Severity: High 7.1 - Published: Feb 6, 2026 - Affected: from 1.34.0, fixed in 1.51.0. - Fixed in 1.51.0 (released Jan 31, 2026, 6 days before disclosure). - The latest release, 2.66.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pydantic-ai-slim Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.