CVE-2026-107295 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
Pydantic AI serves as a Python agent framework designed for constructing applications and workflows utilizing Generative Artificial Intelligence capabilities. Within specific version ranges, specifically from release 1.34.0 up to 1.107.4 in the legacy branch and versions prior to 2.28.0 in the current branch, a critical security deficiency exists within the Agent.to_web() functionality and the associated clai web development chat endpoint. This vulnerability stems directly from missing request content-type validation on the server side when handling incoming HTTP requests intended for local agent execution. The absence of strict validation allows any client capable of sending standard browser-compatible HTTP requests to interact with the loopback-hosted chat server without triggering typical security checks that would otherwise reject malformed or unauthorized payloads.
The operational impact of this flaw is severe due to the nature of how these agents operate within a developer's local environment. A malicious website visited by a developer can initiate a cross-origin request directly to the localhost address where the Pydantic AI agent server is listening. Because modern browsers permit such requests under certain conditions, particularly when targeting loopback interfaces which are often treated with less restrictive same-origin policies in development contexts, an attacker can effectively hijack the execution context of the local process. The served agent proceeds to run and execute tools configured within its definition, doing so with the full privileges and credentials associated with the user account running the Python application. This means that if the developer has administrative rights or access to sensitive local resources, those assets become immediately accessible through a web-based attack vector initiated by simply visiting a compromised webpage.
Furthermore, the vulnerability extends beyond simple execution of unrestricted tools. The issue also impacts mechanisms designed for human-in-the-loop approval workflows. Even when specific tools are configured with requires_approval=True to mandate user consent before execution, client-relayed approval decisions can be manipulated or bypassed through this endpoint. This exposure allows an attacker to potentially force approvals or trick the agent into executing sensitive operations under the guise of legitimate developer interaction. The fundamental misconception that binding a service to localhost provides sufficient security isolation is challenged here, as network-level boundaries do not prevent browser-based scripts from reaching loopback addresses, thereby exposing local development environments to remote code execution risks via social engineering tactics such as malicious web pages or phishing sites.
To mitigate this risk, developers must upgrade immediately to version 1.107.4 for the legacy branch or version 2.28.0 and later for the current branch, where these validation checks have been implemented. In addition to upgrading, it is advisable to implement additional security controls such as requiring explicit authentication tokens for all API requests rather than relying solely on origin headers which can be spoofed. Developers should also consider running agent services in isolated containers or virtual environments with restricted permissions to limit the blast radius of any potential compromise. From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and represents an instance of Server-Side Request Forgery leading to Local File Access or Remote Code Execution depending on the tools available to the agent. In terms of adversary tactics, it facilitates Initial Access via Browser-Based Exploitation as defined in the MITRE ATT&CK framework, highlighting the need for robust input sanitization even in trusted local development environments.