CVE-2026-107295
HIGH
7,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: low
Description
AI Translation Available
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.
352
Cross-Site Request Forgery (CSRF)
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Non-Repudiation
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Read Application Data
Modify Application Data
Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies:
Web Based, Web Server
https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed9…
https://github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaea…
https://github.com/pydantic/pydantic-ai/pull/7382
https://github.com/pydantic/pydantic-ai/pull/7383
https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4
https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93