Vulnerabilities for pydantic-ai

First version without a known vulnerability: 0.0.0

Details

• GHSA-6fqq-452j-qhrp2026-10-08

  Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

  Fixed in: 2.53.0

• GHSA-v36g-jcw9-x7cw2026-10-08

  Pydantic AI: Excessive resource use when local web fetching converts nested HTML

  Fixed in: 1.107.7, 2.52.0

• GHSA-q2xc-rrxj-58x92026-10-08

  Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

  Fixed in: 1.107.5, 2.30.0

• GHSA-h4xc-3qfq-jf932026-10-08

  Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

  Fixed in: 1.107.4, 2.28.0

• GHSA-3gh4-cghq-f8v42026-10-08

  Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

  Fixed in: 1.107.4, 2.27.1

• GHSA-v2xh-2vp8-57h82026-10-08

  Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

  Fixed in: 1.107.2, 2.24.0

• GHSA-fpf4-vwcp-v4hp2026-10-08

  Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

  Fixed in: 1.107.6, 2.44.0

• GHSA-4x9p-g9wm-8q7f2026-10-08

  Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

  Fixed in: 1.107.6, 2.44.0

• GHSA-vmxc-h2x2-jmf32026-10-08

  Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

  Fixed in: 1.107.6, 2.44.0

• GHSA-h7p7-w5gc-xj3w2026-08-13

  Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

  Fixed in: 1.106.0, 2.0.0b6

• GHSA-cg7w-rg45-pc592026-06-26

  pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

  Fixed in: 1.102.0, 2.0.0b3

• GHSA-cqp8-fcvh-x7r32026-05-21

  Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

  Fixed in: 1.99.0

• GHSA-wjp5-868j-wqv72026-02-06

  Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

  Fixed in: 1.51.0

• GHSA-2jrp-274c-jhv32026-02-06

  Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

  Fixed in: 1.56.0