Skip to contentPydantic Pydantic-ai-slim vulnerabilities
- pydantic pydantic-ai, pydantic-ai-slim, ai +2 more`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool executionCVE-2026-107295Fix available7.6 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlCVE-2026-107294Fix available6.5 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`CVE-2026-107293Fix available2.3 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerCVE-2026-107292Fix available6.4 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`CVE-2026-107291Fix available2.3 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`CVE-2026-107290Fix available6.5 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)CVE-2026-107289Fix available6.8 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differentlyCVE-2026-1072883.7 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Excessive resource use when local web fetching converts nested HTMLCVE-2026-107287Fix available6.5 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyCVE-2026-107286Fix available7.5 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 moreVercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injectionCVE-2026-54249Fix available6.8 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`CVE-2026-659756.5 Medium
- pydantic pydantic-ai, ai, pydantic-ai-slim +2 morepydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)CVE-2026-48782Fix available6.8 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)CVE-2026-46678Fix available6.8 Medium