Pydantic AI patches six flaws in its agent framework

Pydantic published six security advisories for its Pydantic AI agent framework on 8 October 2026, covering flaws in the development web chat UI, the local web-fetch tool, media downloads, OpenTelemetry instrumentation and model concurrency limits. The affected packages are pydantic-ai and pydantic-ai-slim, and fixes are available on both the v1 maintenance line and v2.

The two most serious issues concern the development chat interface served by Agent.to_web() or the clai web command. According to advisory GHSA-h4xc-3qfq-jf93 (CVE-2026-107295), the chat endpoint did not check the content type of incoming requests, so a website a developer visited could submit a request to the chat UI running on that developer's machine. That caused the served agent to run and execute its tools with the privileges and credentials of the local process. Binding the UI to localhost, which is the default, does not prevent this, because a page open in the developer's browser can reach the loopback address. Pydantic said tools marked requires_approval=True were also unprotected, because the endpoint trusts approval decisions relayed by the client. The fix requires a Content-Type: application/json header and rejects other requests before the body is parsed. The advisory credits Thai Son Dinh of VinSOC Labs.

A related advisory, GHSA-q2xc-rrxj-58x9 (CVE-2026-107292), says the same endpoint does not validate the Host header, allowing DNS rebinding to make a malicious site's requests appear same-origin to the browser. Because the page then counts as same-origin, neither an Origin check nor a CSRF token constrains it. Pydantic noted that Chromium's Local Network Access protection gates loopback subresource requests but not top-level navigations, and that Safari does not implement it. Patched versions 2.30.0 and 1.107.5 reject requests unless the host is localhost, a loopback or LAN address, or explicitly allowed.

GHSA-3gh4-cghq-f8v4 (CVE-2026-107293) describes a telemetry leak. The setting InstrumentationSettings(include_content=False) is meant to keep prompts, completions and tool arguments out of exported traces. Retry prompts that were not tied to a tool call — which arise with structured output modes such as NativeOutput or PromptedOutput, or with output validators on text output — were recorded in full anyway. Pydantic said this grants no new access to the agent, but validation feedback can quote invalid values from the model's output, so withheld content could reach a third-party or shared observability backend. Users who relied on the setting are advised to review previously exported traces. The issue was reported privately by the University of Sydney Security Research Team and later independently disclosed with a fix by a community contributor.

The remaining three advisories are availability problems. CVE-2026-107294 covers unbounded memory use: download paths buffered entire HTTP response bodies before applying size limits, so an agent driven to fetch an attacker-chosen URL could exhaust process memory. Patched versions enforce a default 50 MiB cap while streaming. CVE-2026-107287 covers excessive CPU and memory use when the local web-fetch tool converts deeply nested HTML to Markdown. CVE-2026-107286 covers ConcurrencyLimitedModel, where a streamed request that ends early can permanently retain its slot, so a client that repeatedly starts and drops streams can exhaust shared capacity.

Pydantic recommends upgrading. Stated workarounds include scrubbing telemetry attributes, avoiding local web fetching of attacker-controlled HTML, and not running the web UI while browsing untrusted sites.