Pydantic AI: a website the developer visits can run the local chat agent and its tools (CVE-2026-107295, 7.6), DNS rebinding on the same endpoint (CVE-2026-107292), an incomplete metadata-SSRF fix (CVE-2026-107289); ten vendor advisories Aug 8 to Oct 2, seven CVEs on 2026-10-08, fixed 1.107.7 / 2.53.0

View raw markdownEdit on GitHub ↗

TL;DR

Pydantic AI (the pydantic-ai / pydantic-ai-slim agent framework, 1.38M PyPI downloads in the week to 2026-10-09) published ten security advisories on its own tab between 2026-08-08 and 2026-10-02. GitHub assigned seven CVEs to them on 2026-10-08, which is when they reached the advisory database and scanners. The two that matter most are in the development chat UI that Agent.to_web() and clai web serve on localhost: CVE-2026-107295 (CVSS 7.6) lets any website open in the developer's browser post a request to the loopback chat endpoint and make the served agent run, with its tools, under the local process's credentials, and CVE-2026-107292 (6.4) lets a DNS-rebinding page reach the same endpoint as a same-origin service because the Host header was never checked. Binding to localhost does not stop either. CVE-2026-107289 (6.8) is an incomplete fix of two earlier cloud-metadata SSRF bugs. The lowest releases that carry every fix are 1.107.7 on the v1 line and 2.53.0 on v2 (current release 2.54.0). Upgrade, and stop running the dev chat UI while browsing.

What happened

Pydantic AI's maintainers published the advisories on the repository tab over eight weeks; none had a CVE until GitHub, acting as CNA, issued seven on 2026-10-08. The corpus had no file on the product. Dated by the vendor's advisory date, as the sweep rules require.

Vendor date Advisory CVE Score What it is Affected Fixed
2026-08-08 GHSA-v2xh-2vp8-57h8 CVE-2026-107294 6.5 web_fetch_tool and FileUrl media downloads buffered the whole HTTP body before any size limit; a model-chosen URL exhausts memory 1.77.0 to <1.107.2; 2.0.0b1 to ≤2.23.0 1.107.2 / 2.24.0 (50 MiB streaming cap)
2026-08-12 GHSA-h4xc-3qfq-jf93 CVE-2026-107295 7.6 The chat endpoint did not check the request content type, so a cross-origin page can submit a browser-simple request that runs the agent and its tools; approval decisions relayed by the client left requires_approval=True tools exposed too 1.34.0 to <1.107.4; 2.0.0b1 to <2.28.0 1.107.4 / 2.28.0 (endpoint now requires Content-Type: application/json)
2026-08-12 GHSA-3gh4-cghq-f8v4 CVE-2026-107293 2.3 OpenTelemetry include_content=False still exported retry prompts, which can quote invalid model output 0.3.4 to <1.107.4; 2.0.0b1 to <2.27.1 1.107.4 / 2.27.1
2026-08-14 GHSA-q2xc-rrxj-58x9 CVE-2026-107292 6.4 No Host header validation on the chat endpoint, so DNS rebinding makes a hostile page same-origin with the local agent; origin checks and CSRF tokens do not help on that path 1.34.0 to <1.107.5; 2.0.0b1 to <2.30.0 1.107.5 / 2.30.0 (returns 421 for unknown hosts; allowed_hosts= for proxies and tunnels)
2026-09-17 GHSA-vmxc-h2x2-jmf3 CVE-2026-107289 6.8 An IPv6 zone identifier on a metadata address slipped past the cloud-metadata blocklist when a URL was opted into local access; the vendor calls it an incomplete fix of CVE-2026-46678 and CVE-2026-48782 1.56.0 to <1.107.6; 2.0.0b1 to <2.44.0 1.107.6 / 2.44.0
2026-09-17 GHSA-22h6-qm39-v87j CVE-2026-107288 3.7 blocked_domains compared raw strings while the resolver normalised fullwidth and similar spellings to the blocked name 1.77.0 to <1.107.6; 2.0.0b1 to <2.44.0 1.107.6 / 2.44.0
2026-09-17 GHSA-4x9p-g9wm-8q7f CVE-2026-107291 2.3 include_content=False did not redact exceptions, error statuses, instructions or the output template from spans 0.3.4 to <1.107.6; 2.0.0b1 to <2.44.0 1.107.6 / 2.44.0
2026-09-17 GHSA-fpf4-vwcp-v4hp none seen Moderate Event loop blocked by quadratic response processing in web_fetch (title and severity from the tab listing; not opened)
2026-09-30 GHSA-v36g-jcw9-x7cw CVE-2026-107287 6.5 Converting nested attacker-controlled HTML to Markdown in local web fetching re-processes text at every level; the size limit applies only after conversion 1.77.0 to <1.107.7; 2.0.0b1 to <2.52.0 1.107.7 / 2.52.0
2026-10-02 GHSA-6fqq-452j-qhrp CVE-2026-107286 7.5 ConcurrencyLimitedModel leaks a slot when a streamed request ends early; a client that repeatedly connects and drops can block a shared limiter 2.10.0 to <2.53.0 2.53.0

Two earlier advisories complete the picture: CVE-2026-25640 (vendor 2026-02-06, 7.1), a stored XSS in the same web UI through an unvalidated version query parameter that built a CDN URL, fixed 1.51.0; and CVE-2026-54249 (vendor 2026-06-10, 6.8, reporter EQSTLab), where UI adapters forwarded unvalidated UploadedFile references to the provider, which resolved them with the server's own cloud credentials, fixed 1.106.0 / 2.0.0b6.

Why the chat-UI pair matters. clai web is the quickest way to try an agent, and the agent it serves usually carries the developer's provider keys, the local filesystem tools and whatever MCP servers the project wires in. CVE-2026-107295 needs no trick beyond a form post from a page the developer has open. The fix is a content-type check, which is why the vendor notes that non-browser scripts calling the endpoint may need to send the JSON header. CVE-2026-107292 is the same endpoint reached through DNS rebinding, which the vendor says Chromium's Local Network Access does not cover for top-level navigations and Safari does not implement at all. This is the localhost-agent class the corpus already tracks for MCP SDK servers, Cline's dashboards and the next dev MCP endpoint: a developer tool on 127.0.0.1 is reachable by every page the developer visits.

Credits. Thai Son Dinh (VinSOC Labs) for CVE-2026-107295; euriconicacio for CVE-2026-107289; SounLabs for CVE-2026-107287; lche511 for CVE-2026-107286; the University of Sydney Security Research Team, sean-kim05 and mauriceng98 for the telemetry findings.

Am I affected?

pip show pydantic-ai pydantic-ai-slim 2>/dev/null | grep -E '^(Name|Version)'
# v1 line: anything below 1.107.7 misses at least one fix; v2 line: anything below 2.53.0
grep -rn "to_web(\|clai web\|web_fetch_tool\|allow_local_urls\|force_download" --include=*.py --include=*.md --include=*.toml . | head

You are exposed to the chat-UI bugs if you ran clai web or Agent.to_web() on an affected version while a browser on the same machine could load untrusted pages. You are exposed to the SSRF and memory bugs only if untrusted input can steer a URL the agent fetches, and to CVE-2026-107289 only if you opted a URL into local access.

If you are affected

  1. Upgrade to 1.107.7 or later (v1) or 2.53.0 or later (v2). Pin the floor in your lockfile.
  2. If you cannot upgrade: do not run the dev chat UI while browsing, stop it when idle, and do not serve an agent with side-effecting tools through it. Behind a proxy or tunnel, set allowed_hosts= once on the fixed version.
  3. Treat the agent's tools as having been callable by any page you visited while the UI was up. Review provider usage, file changes and MCP actions for that window, and rotate provider keys if anything looks wrong. See if-your-local-ai-agent-was-exploited.md.
  4. If you relied on include_content=False, review exported traces for prompt content.

Prevention

Put every local agent endpoint behind a host and origin check and a non-default content type, and keep side-effecting tools off anything a browser can reach (agent-sandboxing.md). Prefer allowed_domains to blocked_domains for fetch tools, and never opt an untrusted URL into local access (mcp-hygiene.md). Keep provider keys scoped and short-lived (credential-hygiene.md).

Sources