Security
فارسی
All products

pydantic-ai

PyPI · Package
14 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentialsCVE-2026-54249 · GHSA-H7P7-W5GC-XJ3WVersion ranges need review. pydantic-ai-slimpydantic-ai PyPI Medium Fix reported
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`CVE-2026-107293 · GHSA-3GH4-CGHQ-F8V4Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Low Fix reported
Pydantic AI: Excessive resource use when local web fetching converts nested HTMLCVE-2026-107287 · GHSA-V36G-JCW9-X7CWVersion ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Medium Fix reported
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiersCVE-2026-107289 · GHSA-VMXC-H2X2-JMF3Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Medium Fix reported
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`CVE-2026-107290 · GHSA-FPF4-VWCP-V4HPVersion ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Medium Fix reported
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerCVE-2026-107292 · GHSA-Q2XC-RRXJ-58X9Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Medium Fix reported
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlCVE-2026-107294 · GHSA-V2XH-2VP8-57H8Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Medium Fix reported
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointCVE-2026-107295 · GHSA-H4XC-3QFQ-JF93Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat High Fix reported
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`CVE-2026-107291 · GHSA-4X9P-G9WM-8Q7FVersion ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Low Fix reported
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyCVE-2026-107286 · GHSA-6FQQ-452J-QHRPVersion ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat High Fix reported
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URLCVE-2026-25640 · GHSA-WJP5-868J-WQV7Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat High Fix reported
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)CVE-2026-48782 · GHSA-CG7W-RG45-PC59Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat Medium Fix reported
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)CVE-2026-46678 · GHSA-CQP8-FCVH-X7R3Version ranges need review. pydantic-ai-slimpydantic-ai PyPI Medium Fix reported
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download HandlingCVE-2026-25580 · GHSA-2JRP-274C-JHV3Version ranges need review. pydantic-ai-slimpydantic-ai PyPIRed Hat High Fix reported