CVE-2026-107295 pydantic CVE debrief

Who should care

Developers and applications serving Pydantic AI agents via `Agent.to_web()` or `clai web` should assess exposure and take mitigation actions. This includes verifying if Pydantic AI agents are being served, evaluating the tools exposed by served agents, and upgrading to patched versions. Additionally, security teams and operators should review the vulnerability and its potential impacts on their systems and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-107295 allows websites visited by developers to trigger Pydantic AI agent runs and tool execution with local privileges, potentially leading to data disclosure or unwanted side effects. Developers serving agents via `Agent.to_web()` or `clai web` should verify exposure, assess tool risks, and upgrade to patched versions.

• Data disclosure is possible if agents expose sensitive data.
• Unwanted tool side effects may occur depending on exposed tools.
• Verification of agent configurations and tool approval decisions is necessary.
• Upgrade to patched versions is recommended to prevent exploitation.

Technical summary

The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) is vulnerable to a request injection attack. A website visited by a developer can submit requests to the chat UI running on the developer's machine, causing the served agent to run and execute its tools with local privileges. This issue is mitigated in patched versions which require `Content-Type: application/json` for chat endpoint requests.

Defensive priority

Developers serving Pydantic AI agents via `Agent.to_web()` or `clai web` should verify exposure, assess tool risks, and upgrade to patched versions.

Recommended defensive actions

• Verify if Pydantic AI agents are being served via `Agent.to_web()` or `clai web` and assess exposure.
• Evaluate the tools exposed by served agents and potential data disclosure or unwanted side effects.
• Upgrade to patched versions (e.g., pydantic-ai 1.107.4 or 2.28.0) which require `Content-Type: application/json` for chat endpoint requests.
• Review and update scripts and non-browser clients to ensure they send the required `Content-Type` header.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The Pydantic AI development web chat UI did not check request content types, allowing websites visited by developers to trigger agent runs and tool execution with local privileges. Evidence is based on the supplied source corpus and CVE record. The vulnerability allows websites visited by developers to trigger Pydantic AI agent runs and tool execution with local privileges, potentially leading to data disclosure or unwanted side effects. Developers serving agents via `Agent.to_web()` or `clai web` should verify exposure, assess tool

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.