`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution (pydantic pydantic-ai)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.
Weaknesses (CWE)
- CWE-352 — Cross-Site Request Forgery
References
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93
- https://github.com/pydantic/pydantic-ai/pull/7382
- https://github.com/pydantic/pydantic-ai/pull/7383
- https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46
- https://github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L | GitHub_M |
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-h4xc-3qfq-jf93 — Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- PYSEC-2026-4278 — Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- PYSEC-2026-4287 — Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
European references
- ENISA EUVD · EUVD-2026-95106
- GCVE · GCVE-0-2026-107295
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*≥ 1.34.0 < 1.107.4cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*≥ 2.0.0 < 2.28.0
Affected products
| Product | Versions |
|---|---|
| pydantic · pydantic-ai | affected >= 1.34.0, < 1.107.4 ; affected >= 2.0.0b1, < 2.28.0 |
| pydantic · pydantic-ai-slim | affected >= 1.34.0, < 1.107.4 ; affected >= 2.0.0b1, < 2.28.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |