CVE-2026-25640: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in pydantic pydantic-ai
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data. This vulnerability only affects applications that use Agent.to_web to serve a chat interface and clai web to serve a chat interface from the CLI. These are typically run locally (on localhost), but may also be deployed on a remote server. This vulnerability is fixed in 1.51.0.
AI Analysis
Technical Summary
CVE-2026-25640 is a path traversal vulnerability (CWE-22) in pydantic-ai's web UI affecting versions >=1.34.0 and <1.51.0. The vulnerability arises because the CDN URL is constructed using a version query parameter from the request URL without proper validation. Attackers can exploit this by crafting URLs with path traversal sequences, causing the server to fetch and serve attacker-controlled HTML/JavaScript from the CDN instead of the legitimate chat UI package. This leads to cross-site scripting (CWE-79) in the victim's browser, enabling theft of chat history and other client-side data. The vulnerability only impacts applications using Agent.to_web or clai web to serve chat interfaces. The issue is resolved in version 1.51.0.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the affected application by tricking users into visiting a maliciously crafted URL or iframe. This can lead to theft of chat history and other sensitive client-side data. The vulnerability has a CVSS 3.1 score of 7.1 (High) with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.
Mitigation Recommendations
An official fix is available in pydantic-ai version 1.51.0. Users and administrators should upgrade affected installations to version 1.51.0 or later to remediate this vulnerability. No other vendor mitigation guidance or temporary fixes are indicated. Patch status is confirmed by the vendor advisory.
CVE-2026-25640: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in pydantic pydantic-ai
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data. This vulnerability only affects applications that use Agent.to_web to serve a chat interface and clai web to serve a chat interface from the CLI. These are typically run locally (on localhost), but may also be deployed on a remote server. This vulnerability is fixed in 1.51.0.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-25640 is a path traversal vulnerability (CWE-22) in pydantic-ai's web UI affecting versions >=1.34.0 and <1.51.0. The vulnerability arises because the CDN URL is constructed using a version query parameter from the request URL without proper validation. Attackers can exploit this by crafting URLs with path traversal sequences, causing the server to fetch and serve attacker-controlled HTML/JavaScript from the CDN instead of the legitimate chat UI package. This leads to cross-site scripting (CWE-79) in the victim's browser, enabling theft of chat history and other client-side data. The vulnerability only impacts applications using Agent.to_web or clai web to serve chat interfaces. The issue is resolved in version 1.51.0.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the affected application by tricking users into visiting a maliciously crafted URL or iframe. This can lead to theft of chat history and other sensitive client-side data. The vulnerability has a CVSS 3.1 score of 7.1 (High) with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact.
Mitigation Recommendations
An official fix is available in pydantic-ai version 1.51.0. Users and administrators should upgrade affected installations to version 1.51.0 or later to remediate this vulnerability. No other vendor mitigation guidance or temporary fixes are indicated. Patch status is confirmed by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-04T05:15:41.791Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-25640","vendor":"Red Hat"}]
Threat ID: 69864bcdf9fa50a62f2f48a6
Added to database: 02/06/2026, 20:15:09 UTC
Last enriched: 07/15/2026, 08:40:12 UTC
Last updated: 09/10/2026, 19:36:53 UTC
Views: 262
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.