---
id: 2026-08-pydantic-ai-web-chat-ui-cross-site-agent-tool-execution-cve-batch
title: "Pydantic AI: a website the developer visits can run the local chat agent and its tools (CVE-2026-107295, 7.6), DNS rebinding on the same endpoint (CVE-2026-107292), an incomplete metadata-SSRF fix (CVE-2026-107289); ten vendor advisories Aug 8 to Oct 2, seven CVEs on 2026-10-08, fixed 1.107.7 / 2.53.0"
date_disclosed: 2026-08-12
last_updated: 2026-10-09
severity: high
status: patched
ecosystems: [pypi, ai-agents, agent-frameworks, python]
tools_affected: [pydantic-ai, pydantic-ai-slim, "clai web", "Agent.to_web()", "apps built on Pydantic AI with web_fetch_tool or FileUrl inputs"]
tags: [cve, csrf, dns-rebinding, localhost, agent-framework, tool-execution, ssrf, cloud-metadata, incomplete-fix, dos, telemetry-leak, backfill]
---

## TL;DR
**Pydantic AI** (the `pydantic-ai` / `pydantic-ai-slim` agent framework, 1.38M PyPI downloads in the week to 2026-10-09) published ten security advisories on its own tab between 2026-08-08 and 2026-10-02. GitHub assigned seven CVEs to them on **2026-10-08**, which is when they reached the advisory database and scanners. The two that matter most are in the development chat UI that `Agent.to_web()` and `clai web` serve on localhost: **CVE-2026-107295** (CVSS 7.6) lets any website open in the developer's browser post a request to the loopback chat endpoint and make the served agent run, with its tools, under the local process's credentials, and **CVE-2026-107292** (6.4) lets a DNS-rebinding page reach the same endpoint as a same-origin service because the `Host` header was never checked. Binding to localhost does not stop either. **CVE-2026-107289** (6.8) is an incomplete fix of two earlier cloud-metadata SSRF bugs. The lowest releases that carry every fix are **1.107.7** on the v1 line and **2.53.0** on v2 (current release 2.54.0). Upgrade, and stop running the dev chat UI while browsing.

## What happened
Pydantic AI's maintainers published the advisories on the repository tab over eight weeks; none had a CVE until GitHub, acting as CNA, issued seven on 2026-10-08. The corpus had no file on the product. Dated by the vendor's advisory date, as the sweep rules require.

| Vendor date | Advisory | CVE | Score | What it is | Affected | Fixed |
|---|---|---|---|---|---|---|
| 2026-08-08 | GHSA-v2xh-2vp8-57h8 | CVE-2026-107294 | 6.5 | `web_fetch_tool` and `FileUrl` media downloads buffered the whole HTTP body before any size limit; a model-chosen URL exhausts memory | 1.77.0 to <1.107.2; 2.0.0b1 to ≤2.23.0 | 1.107.2 / 2.24.0 (50 MiB streaming cap) |
| 2026-08-12 | GHSA-h4xc-3qfq-jf93 | CVE-2026-107295 | **7.6** | The chat endpoint did not check the request content type, so a cross-origin page can submit a browser-simple request that runs the agent and its tools; approval decisions relayed by the client left `requires_approval=True` tools exposed too | 1.34.0 to <1.107.4; 2.0.0b1 to <2.28.0 | 1.107.4 / 2.28.0 (endpoint now requires `Content-Type: application/json`) |
| 2026-08-12 | GHSA-3gh4-cghq-f8v4 | CVE-2026-107293 | 2.3 | OpenTelemetry `include_content=False` still exported retry prompts, which can quote invalid model output | 0.3.4 to <1.107.4; 2.0.0b1 to <2.27.1 | 1.107.4 / 2.27.1 |
| 2026-08-14 | GHSA-q2xc-rrxj-58x9 | CVE-2026-107292 | 6.4 | No `Host` header validation on the chat endpoint, so DNS rebinding makes a hostile page same-origin with the local agent; origin checks and CSRF tokens do not help on that path | 1.34.0 to <1.107.5; 2.0.0b1 to <2.30.0 | 1.107.5 / 2.30.0 (returns 421 for unknown hosts; `allowed_hosts=` for proxies and tunnels) |
| 2026-09-17 | GHSA-vmxc-h2x2-jmf3 | CVE-2026-107289 | 6.8 | An IPv6 zone identifier on a metadata address slipped past the cloud-metadata blocklist when a URL was opted into local access; the vendor calls it an incomplete fix of CVE-2026-46678 and CVE-2026-48782 | 1.56.0 to <1.107.6; 2.0.0b1 to <2.44.0 | 1.107.6 / 2.44.0 |
| 2026-09-17 | GHSA-22h6-qm39-v87j | CVE-2026-107288 | 3.7 | `blocked_domains` compared raw strings while the resolver normalised fullwidth and similar spellings to the blocked name | 1.77.0 to <1.107.6; 2.0.0b1 to <2.44.0 | 1.107.6 / 2.44.0 |
| 2026-09-17 | GHSA-4x9p-g9wm-8q7f | CVE-2026-107291 | 2.3 | `include_content=False` did not redact exceptions, error statuses, instructions or the output template from spans | 0.3.4 to <1.107.6; 2.0.0b1 to <2.44.0 | 1.107.6 / 2.44.0 |
| 2026-09-17 | GHSA-fpf4-vwcp-v4hp | none seen | Moderate | Event loop blocked by quadratic response processing in `web_fetch` (title and severity from the tab listing; not opened) | | |
| 2026-09-30 | GHSA-v36g-jcw9-x7cw | CVE-2026-107287 | 6.5 | Converting nested attacker-controlled HTML to Markdown in local web fetching re-processes text at every level; the size limit applies only after conversion | 1.77.0 to <1.107.7; 2.0.0b1 to <2.52.0 | 1.107.7 / 2.52.0 |
| 2026-10-02 | GHSA-6fqq-452j-qhrp | CVE-2026-107286 | 7.5 | `ConcurrencyLimitedModel` leaks a slot when a streamed request ends early; a client that repeatedly connects and drops can block a shared limiter | 2.10.0 to <2.53.0 | 2.53.0 |

Two earlier advisories complete the picture: **CVE-2026-25640** (vendor 2026-02-06, 7.1), a stored XSS in the same web UI through an unvalidated `version` query parameter that built a CDN URL, fixed 1.51.0; and **CVE-2026-54249** (vendor 2026-06-10, 6.8, reporter EQSTLab), where UI adapters forwarded unvalidated `UploadedFile` references to the provider, which resolved them with the server's own cloud credentials, fixed 1.106.0 / 2.0.0b6.

**Why the chat-UI pair matters.** `clai web` is the quickest way to try an agent, and the agent it serves usually carries the developer's provider keys, the local filesystem tools and whatever MCP servers the project wires in. CVE-2026-107295 needs no trick beyond a form post from a page the developer has open. The fix is a content-type check, which is why the vendor notes that non-browser scripts calling the endpoint may need to send the JSON header. CVE-2026-107292 is the same endpoint reached through DNS rebinding, which the vendor says Chromium's Local Network Access does not cover for top-level navigations and Safari does not implement at all. This is the localhost-agent class the corpus already tracks for [MCP SDK servers](2026-09-mcp-python-sdk-oauth-issuer-validation-credential-redirect.md), [Cline's dashboards](2026-06-cline-cve-2026-44211-websocket-rce.md) and [the `next dev` MCP endpoint](2026-09-nextjs-september-2026-security-release-seven-advisories.md): a developer tool on 127.0.0.1 is reachable by every page the developer visits.

**Credits.** Thai Son Dinh (VinSOC Labs) for CVE-2026-107295; euriconicacio for CVE-2026-107289; SounLabs for CVE-2026-107287; lche511 for CVE-2026-107286; the University of Sydney Security Research Team, sean-kim05 and mauriceng98 for the telemetry findings.

## Am I affected?
```bash
pip show pydantic-ai pydantic-ai-slim 2>/dev/null | grep -E '^(Name|Version)'
# v1 line: anything below 1.107.7 misses at least one fix; v2 line: anything below 2.53.0
grep -rn "to_web(\|clai web\|web_fetch_tool\|allow_local_urls\|force_download" --include=*.py --include=*.md --include=*.toml . | head
```
You are exposed to the chat-UI bugs if you ran `clai web` or `Agent.to_web()` on an affected version while a browser on the same machine could load untrusted pages. You are exposed to the SSRF and memory bugs only if untrusted input can steer a URL the agent fetches, and to CVE-2026-107289 only if you opted a URL into local access.

## If you are affected
1. Upgrade to **1.107.7 or later** (v1) or **2.53.0 or later** (v2). Pin the floor in your lockfile.
2. If you cannot upgrade: do not run the dev chat UI while browsing, stop it when idle, and do not serve an agent with side-effecting tools through it. Behind a proxy or tunnel, set `allowed_hosts=` once on the fixed version.
3. Treat the agent's tools as having been callable by any page you visited while the UI was up. Review provider usage, file changes and MCP actions for that window, and rotate provider keys if anything looks wrong. See [if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md).
4. If you relied on `include_content=False`, review exported traces for prompt content.

## Prevention
Put every local agent endpoint behind a host and origin check and a non-default content type, and keep side-effecting tools off anything a browser can reach ([agent-sandboxing.md](../prevention/agent-sandboxing.md)). Prefer `allowed_domains` to `blocked_domains` for fetch tools, and never opt an untrusted URL into local access ([mcp-hygiene.md](../prevention/mcp-hygiene.md)). Keep provider keys scoped and short-lived ([credential-hygiene.md](../prevention/credential-hygiene.md)).

## Sources
- [pydantic/pydantic-ai — Security Advisories](https://github.com/pydantic/pydantic-ai/security/advisories) (walked 2026-10-09; ten entries dated 2026-08-08 to 2026-10-02)
- [GHSA-h4xc-3qfq-jf93 — a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93) (CVE-2026-107295, 7.6, `AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L`, fixed 1.107.4 / 2.28.0, content-type fix, workarounds, credit Thai Son Dinh / VinSOC Labs)
- [GHSA-q2xc-rrxj-58x9 — the local chat endpoint does not validate the Host header](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9) (CVE-2026-107292, 6.4, fixed 1.107.5 / 2.30.0, `allowed_hosts`, browser-protection caveats)
- [GHSA-vmxc-h2x2-jmf3 — SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-vmxc-h2x2-jmf3) (CVE-2026-107289, 6.8, incomplete fix of CVE-2026-46678 / CVE-2026-48782, fixed 1.107.6 / 2.44.0)
- [GHSA-22h6-qm39-v87j](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-22h6-qm39-v87j) (CVE-2026-107288, 3.7), [GHSA-4x9p-g9wm-8q7f](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7f) (CVE-2026-107291, 2.3), [GHSA-3gh4-cghq-f8v4](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4) (CVE-2026-107293, 2.3), [GHSA-v2xh-2vp8-57h8](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8) (CVE-2026-107294, 6.5), [GHSA-v36g-jcw9-x7cw](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw) (CVE-2026-107287, 6.5), [GHSA-6fqq-452j-qhrp](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-6fqq-452j-qhrp) (CVE-2026-107286, 7.5) — all fetched 2026-10-09
- [CVE Services — CVE-2026-107295](https://cveawg.mitre.org/api/cve/CVE-2026-107295), [CVE-2026-107292](https://cveawg.mitre.org/api/cve/CVE-2026-107292), [CVE-2026-107289](https://cveawg.mitre.org/api/cve/CVE-2026-107289), [CVE-2026-107286](https://cveawg.mitre.org/api/cve/CVE-2026-107286) (GitHub as CNA, all published 2026-10-08; ranges, vectors, fix PRs #7382/#7383 and #7437/#7438)
- [GitHub Advisory Database — GHSA-wjp5-868j-wqv7 (CVE-2026-25640)](https://github.com/advisories/GHSA-wjp5-868j-wqv7) and [GHSA-h7p7-w5gc-xj3w (CVE-2026-54249)](https://github.com/advisories/GHSA-h7p7-w5gc-xj3w) (the two earlier web-UI and adapter advisories)
- [GitHub Advisory Database — `agent` recency listing](https://github.com/advisories?query=agent+sort%3Apublished-desc) (where the 2026-10-08 rows surfaced); PyPI release list via `pip index versions pydantic-ai` (2.54.0 current, 1.107.7 top of the v1 line) and pypistats recent downloads (1,383,442 last week), both checked 2026-10-09