CVE Tools
Track your stack

Pydantic-ai

16 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Pydantic-ai, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Pydantic-ai CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Pydantic-ai CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-022
2026-030
2026-040
2026-050
2026-061
2026-073
2026-080
2026-090
2026-1010

Severity

How the 16 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High425%
  • Medium1169%
  • Low16%

Latest CVEs

The 15 most recently published vulnerabilities affecting Pydantic-ai.

  1. CVE-2026-107295`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution7.6
  2. CVE-2026-107294Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl6.5
  3. CVE-2026-107293Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`5.3
  4. CVE-2026-107292Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header6.4
  5. CVE-2026-107291Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`4.3
  6. CVE-2026-107290Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`6.5
  7. CVE-2026-107289Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)6.8
  8. CVE-2026-107288Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently3.7
  9. CVE-2026-107287Pydantic AI: Excessive resource use when local web fetching converts nested HTML6.5
  10. CVE-2026-107286Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early7.5
  11. CVE-2026-54249VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection6.8
  12. CVE-2026-46678Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)6.8
  13. CVE-2026-65975Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`6.5
  14. CVE-2026-48782pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)6.8
  15. CVE-2026-25580Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling8.6

Product grouping is registry-driven, with AI assist and human review. How it works