Threat Intelligence Database

CVE-2026-54249 is a Server-Side Request Forgery (SSRF) vulnerability in pydantic-ai that allows a client submitting message history to reference arbitrary files accessible by the server's credentials. This occurs because UploadedFile references are forwarded without proper validation, enabling unauthorized file access. The issue affects versions from 1.65.0 up to and including 1.105.0. A patch is available in versions 1.106.0 and 2.0.0b6 that adds validation for UploadedFile references. If upgrading is not possible, users should avoid passing untrusted message history or strip UploadedFile parts before processing.

CVE-2026-46678 is a Server-Side Request Forgery (SSRF) vulnerability in pydantic-ai versions 1.56.0 through 1.98.0. It allows bypassing the cloud-metadata blocklist by encoding metadata IP addresses in IPv6 transition forms when force_download='allow-local' is enabled on URLs influenced by untrusted input. This can expose cloud IAM short-term credentials on dual-stack or translated networks. The issue is a partial bypass of a previous fix (CVE-2026-25580) and is fixed in version 1.99.0. Applications not explicitly opting into force_download='allow-local' or using bundled integrations are not affected.

CVE-2026-65975 is an incorrect authorization vulnerability in pydantic-ai, a Python agent framework for Generative AI applications. In affected versions, certain UI adapters improperly sanitize client-submitted tool calls, allowing a remote client to trigger execution of registered server tools with client-supplied arguments, bypassing model-generated argument checks. This flaw is fixed in versions 1.107.1 and 2.5.0.

CVE-2026-48782 is a Server-Side Request Forgery (SSRF) vulnerability in the pydantic-ai Python framework versions 1.56.0 through 1.101.0 and 2.0.0. The vulnerability allows bypassing the cloud-metadata IP blocklist by encoding the metadata IP using certain IPv6 transition forms that were not decoded by a previous fix. This can expose cloud IAM short-term credentials when the application opts to allow local URL downloads and runs on networks routing these IPv6 transition forms. The issue is fixed in version 2.0.0b3.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affects applications that accept message history from external users. This vulnerability is fixed in 1.56.0.

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data. This vulnerability only affects applications that use Agent.to_web to serve a chat interface and clai web to serve a chat interface from the CLI. These are typically run locally (on localhost), but may also be deployed on a remote server. This vulnerability is fixed in 1.51.0.