CVE-2026-65975 in pydantic
Summary
by MITRE • 07/29/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before_model_request / after_model_request), since a forged call skips the model turn and bypasses that guardrail; approval-gated tools (requires_approval=True) are not auto-executed by this path. This issue has been fixed in versions 1.107.1 and 2.5.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
Pydantic AI represents a Python-based framework designed for constructing generative AI applications and workflows, incorporating specialized UI adapters including AG-UI via Agent.to_ag_ui() and Vercel AI through VercelAIAdapter. The vulnerability stems from a flawed sanitization mechanism that processes message history before it reaches the agent component, specifically targeting unresolved client-submitted tool calls within untrusted contexts. This security flaw manifests in the implementation of sanitize_messages function which operates as a defensive measure to prevent agents from executing tool calls that were never originally generated by the model itself. The system's design initially included a mechanism to strip dangling tool calls while maintaining message integrity through index-based tracking, but this approach contained a critical timing issue.
The technical implementation flaw occurs when the sanitization process computes a message index prior to execution, creating a race condition in message handling sequences. When trailing client messages undergo sanitization and become empty, they are subsequently dropped from the conversation history. This removal alters the message tail position, causing a preceding assistant response containing unresolved tool calls to become the new terminal message. The system then dispatches this modified message sequence without proper inspection or validation, effectively bypassing the intended security controls. This vulnerability specifically affects scenarios where client system messages under default manage_system_prompt='server' settings are sanitized and removed from the conversation flow.
The operational impact of this vulnerability represents a significant authorization bypass issue that allows remote attackers to execute server-side tools with arbitrary arguments provided by malicious clients rather than those generated by the AI model. The security implications are particularly severe for applications implementing model-request hooks such as before_model_request or after_model_request, since these guardrails are completely circumvented when forged tool calls skip the model turn entirely. The vulnerability's scope is limited by the actual capabilities of registered tools within the system, but it becomes most critical when tools lack proper approval mechanisms. Tools configured with requires_approval=True remain protected because they cannot be auto-executed through this particular pathway, though the bypass mechanism still represents a fundamental flaw in the message sanitization logic.
This vulnerability demonstrates characteristics consistent with CWE-20: Improper Input Validation and CWE-843: Access of Resource Using Inappropriate Whitespace, while also exhibiting elements of privilege escalation through improper authorization checking. The attack pattern aligns with ATT&CK techniques involving privilege escalation through input manipulation and command injection. The fix implemented in versions 1.107.1 and 2.5.0 addresses the core issue by modifying the sanitization process to maintain proper message indexing throughout the processing sequence, ensuring that tool call validation occurs at appropriate points regardless of message history modifications. This remediation restores the intended security boundaries between client-submitted content and server-side tool execution, preventing unauthorized tool invocation through manipulated conversation histories.