Advisoriesby Ibis
pydantic-ai security advisories
14 advisories · 4 critical or high in 12 months · latest Oct 8
14 advisories
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyCVE-2026-107286fixed in 2.53.0Pydantic AI: Excessive resource use when local web fetching converts nested HTMLCVE-2026-107287fixed in 1.107.7 +1pydantic-ai: cross-site request forgeryCVE-2026-107292fixed in 1.107.5 +1pydantic-ai: origin validation errorCVE-2026-107295fixed in 1.107.4 +1Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`CVE-2026-107293fixed in 1.107.4 +1Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlCVE-2026-107294fixed in 1.107.2 +1Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`CVE-2026-107290fixed in 1.107.6 +1pydantic-ai: secrets in logsCVE-2026-107291fixed in 1.107.6 +1Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiersCVE-2026-107289fixed in 1.107.6 +1pydantic-ai: server-side request forgeryCVE-2026-54249fixed in 1.106.0 +1pydantic-ai: server-side request forgeryCVE-2026-48782fixed in 1.102.0 +1Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)CVE-2026-46678fixed in 1.99.0Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URLCVE-2026-25640fixed in 1.51.0Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download HandlingCVE-2026-25580fixed in 1.56.0About pydantic-ai
How Python does AI. Agents, realtime voice, image generation, embeddings. Every model, every interface, typed end to end.
Packages watched: pydantic-ai (PyPI).