pydantic pydantic-ai-slim
14 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-107295 | >= 1.34.0, < 1.107.4 ; >= 2.0.0b1, < 2.28.0 | `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution | HIGH 7.6 | 0.2 % | ||
| CVE-2026-107294 | >= 1.77.0, < 1.107.2 ; >= 2.0.0b1, < 2.24.0 | Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-107293 | >= 0.3.4, < 1.107.4 ; >= 2.0.0b1, < 2.27.1 | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` | LOW 2.3 | 0.3 % | ||
| CVE-2026-107292 | >= 1.34.0, < 2.0.0b1 ; >= 2.0.0b1, < 2.30.0 | Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-107291 | >= 0.3.4, < 1.107.6 ; >= 2.0.0b1, < 2.44.0 | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` | LOW 2.3 | 0.6 % | ||
| CVE-2026-107290 | >= 1.77.0, < 1.107.6 ; >= 2.0.0b1, < 2.44.0 | Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-107289 | >= 1.56.0, < 1.107.6 ; >= 2.0.0b1, < 2.44.0 | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782) | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-107288 | >= 1.77.0, < 1.107.6 ; >= 2.0.0b1, < 2.44.0 | Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently | LOW 3.7 | 0.4 % | ||
| CVE-2026-107287 | >= 1.77.0, < 1.107.7 ; >= 2.0.0b1, < 2.52.0 | Pydantic AI: Excessive resource use when local web fetching converts nested HTML | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-107286 | >= 2.10.0, < 2.53.0 | Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early | HIGH 7.5 | 0.4 % | ||
| CVE-2026-54249 | >= 2.0.0b1, < 2.0.0b6 ; >= 1.65.0, < 1.106.0 | VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata in… | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-46678 | >= 1.56.0, < 1.99.0 | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580) | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-65975 | >= 1.88.0, < 1.107.1 ; >= 2.0.0b1, < 2.5.0 | Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages` | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-48782 | >= 2.0.0b1, < 2.0.0b3 ; >= 1.56.0, < 1.102.0 | pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678) | MEDIUM 6.8 | 0.4 % |