pydantic-ai vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107286Highpydantic-ai: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyCVE-2026-107287Mediumpydantic-ai: Pydantic AI: Excessive resource use when local web fetching converts nested HTMLCVE-2026-107292Mediumpydantic-ai: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerCVE-2026-107295Highpydantic-ai: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool…CVE-2026-107293Lowpydantic-ai: Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`CVE-2026-107294Mediumpydantic-ai: Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlCVE-2026-107290Mediumpydantic-ai: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`CVE-2026-107291Lowpydantic-ai: Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`CVE-2026-107289Mediumpydantic-ai: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiersCVE-2026-54249Mediumpydantic-ai-slim: Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentialsCVE-2026-48782Mediumpydantic-ai-slim: pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)CVE-2026-46678Mediumpydantic-ai: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)CVE-2026-25640Highpydantic-ai: Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URLCVE-2026-25580Highpydantic-ai: Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo