Pydantic AI vulnerabilities

In Pydantic AI before versions 1.107.1 and 2.5.0, UI adapters (AG-UI and Vercel AI) incorrectly strip unresolved tool calls from message history. A client can cause a registered server tool to run with client-supplied arguments, bypassing the model and its guardrails.

In Pydantic AI before versions 1.106.0 and 2.0.0b6, the UI adapter (e.g., Vercel AI) does not validate UploadedFile references. A client can reference arbitrary files in the model provider or cloud storage account using server-side identity, potentially leading to unauthorized data access.

In Pydantic AI before version 1.99.0, when an application enables force_download='allow-local' for a URL, the cloud metadata blocklist can be bypassed by encoding the metadata IP in IPv6 form (e.g., IPv4-mapped IPv6), potentially exposing cloud IAM short-term credentials.

In versions 1.56.0 through 1.101.0 and 2.0.0b1 and 2.0.0b2 of the Pydantic AI framework, the cloud metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form, leading to the exposure of short-term IAM credentials in the cloud. The previous fix did not decode all IPv6 transition forms, resulting in a security vulnerability.

A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality from version 0.0.26 to before 1.56.0. Attackers can include malicious URLs in message history, causing the server to make HTTP requests to internal network resources.

In Pydantic AI versions 1.34.0 through 1.50.0, a path traversal vulnerability in the web UI allows an attacker to craft a malicious URL that fetches and executes arbitrary JavaScript from an external source on the same CDN instead of the legitimate chat UI package. This affects applications using Agent.to_web or clai web to serve a chat interface.