CVE-2026-25640
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In Pydantic AI versions 1.34.0 through 1.50.0, a path traversal vulnerability in the web UI allows an attacker to craft a malicious URL that fetches and executes arbitrary JavaScript from an external source on the same CDN instead of the legitimate chat UI package. This affects applications using Agent.to_web or clai web to serve a chat interface.
Risk Assessment
The risk is that an attacker can steal chat history and other client-side data if a victim clicks the crafted link or visits it via an iframe. The vulnerability can be exploited both in local (localhost) and remote server deployments.
Recommendation
Immediately upgrade Pydantic AI to version 1.51.0 or later, which contains the fix. If upgrading is not possible, restrict access to the web interface to trusted networks only.
Other vulnerabilities in Pydantic AI
See all- CVE-2026-65975Medium
In Pydantic AI before versions 1.107.1 and 2.5.0, UI adapters (AG-UI and Vercel AI) incorrectly strip unresolved tool calls from message history. A client can cause a registered server tool to run with client-supplied arguments, bypassing the model and its guardrails.
- CVE-2026-54249Medium
In Pydantic AI before versions 1.106.0 and 2.0.0b6, the UI adapter (e.g., Vercel AI) does not validate UploadedFile references. A client can reference arbitrary files in the model provider or cloud storage account using server-side identity, potentially leading to unauthorized data access.
- CVE-2026-46678Medium
In Pydantic AI before version 1.99.0, when an application enables force_download='allow-local' for a URL, the cloud metadata blocklist can be bypassed by encoding the metadata IP in IPv6 form (e.g., IPv4-mapped IPv6), potentially exposing cloud IAM short-term credentials.
- CVE-2026-48782Medium
In versions 1.56.0 through 1.101.0 and 2.0.0b1 and 2.0.0b2 of the Pydantic AI framework, the cloud metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form, leading to the exposure of short-term IAM credentials in the cloud. The previous fix did not decode all IPv6 transition forms, resulting in a security vulnerability.
- CVE-2026-25580High
A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality from version 0.0.26 to before 1.56.0. Attackers can include malicious URLs in message history, causing the server to make HTTP requests to internal network resources.
Original NVD description (English source)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data. This vulnerability only affects applications that use Agent.to_web to serve a chat interface and clai web to serve a chat interface from the CLI. These are typically run locally (on localhost), but may also be deployed on a remote server. This vulnerability is fixed in 1.51.0.