Log in Start free

Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107295`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

High 7.6

In plain English

A high-severity cross-site request forgery in pydantic-ai from pydantic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.2%top 95.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpydantic-ai1.107.4GHSA-h4xc-3qfq-jf93
PyPIpydantic-ai2.28.0GHSA-h4xc-3qfq-jf93
PyPIpydantic-ai1.107.4, 2.28.0PYSEC-2026-4278
PyPIpydantic-ai-slim1.107.4GHSA-h4xc-3qfq-jf93
PyPIpydantic-ai-slim2.28.0GHSA-h4xc-3qfq-jf93
PyPIpydantic-ai-slim1.107.4, 2.28.0PYSEC-2026-4287

Affected products (as reported)

VendorProductVersions
pydantic pydantic-ai >= 1.34.0, < 1.107.4>= 2.0.0b1, < 2.28.0
pydantic pydantic-ai-slim >= 1.34.0, < 1.107.4>= 2.0.0b1, < 2.28.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

References