These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Pydantic AI Harness before 0.59.0 has a tool-call limit bypass vulnerability in nested CodeMode calls. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_calls, exceeding operator limits on costly or side-effecting tools. This vulnerability allows for potential excessive resource usage or unauthorized actions. Operators and users sh [truncated]
CVE-2026-107286 debrief: Pydantic AI's ConcurrencyLimitedModel can retain slots when streamed requests end early, potentially causing denial of service. This issue arises from anyio.CapacityLimiter associating an acquired slot with the borrowing task, while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with [truncated]
CVE-2026-107295: Pydantic AI Web chat UI vulnerability allows server-side tool execution. The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) is vulnerable to a request injection attack. A website visited by a developer can submit requests to the chat UI running on the developer's machine, causing the served agent to run and execute its tools with local privileges. This issue is mitigat [truncated]
Pydantic AI's OpenTelemetry instrumentation supports `InstrumentationSettings(include_content=False)` to exclude message content from exported telemetry. However, retry prompts were not covered by this setting when they were not associated with a tool call, potentially allowing sensitive content to reach the telemetry backend. This oversight could impact defenders who rely on this setting to protect sensi [truncated]
Pydantic AI is vulnerable to unbounded memory use when downloading remote content via web_fetch or FileUrl. This issue, affecting versions 1.77.0 through 1.107.2 and 2.24.0, can lead to a denial-of-service (DoS) attack, causing the worker to crash due to memory exhaustion. The attack is limited to availability and does not allow for SSRF bypasses or other malicious actions.
Pydantic AI is vulnerable to a denial-of-service (DoS) attack due to quadratic title extraction in the `web_fetch` tool. An attacker-controlled webpage can cause the event loop to block for an extended period, impacting other agent runs and requests. This issue arises from the tool's handling of server-controlled responses, which can lead to event loop blocking and potential system stalls. Defenders shoul [truncated]
Pydantic AI's OpenTelemetry instrumentation has a misconfiguration that causes exception events on tool and agent run spans to include content even when `include_content=False` is set. This may inadvertently expose sensitive information such as user prompts, model completions, and tool call arguments and responses. The misconfiguration affects several parts of the spans, including exceptions, and can lead [truncated]
Pydantic AI applications can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address when opt-in settings are enabled, potentially exposing cloud IAM credentials. This issue arises in IPv6-enabled environments using Pydantic AI versions 1.56.0 through 1.107.6 and 2.44.0. The opt-in settings are disabled by default, but when enabled, they allow an attacker to in [truncated]
CVE-2026-107292: Pydantic AI Web chat UI DNS rebinding vulnerability allows local chat endpoint exploitation. The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) does not validate the `Host` header of incoming requests, allowing DNS rebinding attacks. This vulnerability can lead to data disclosure and unwanted tool side effects. Developers serving Pydantic AI agents via `Agent.to_web()` [truncated]
Pydantic AI's web_fetch_tool has a blocked_domains bypass vulnerability via a hostname that the resolver normalizes differently. This issue affects Pydantic AI versions from 1.77.0 until 1.107.6 and 2.44.0. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured str [truncated]
Pydantic AI, a Python agent framework for building applications and workflows with Generative AI, is vulnerable to excessive resource use when local web fetching converts nested HTML. This issue affects versions from 1.77.0 until 1.107.7 and 2.52.0 of Pydantic AI and Pydantic AI Slim. The vulnerability can cause a model-directed fetch to delay other work in the process, potentially impacting system perfor [truncated]
The HTTPX2 library, a next-generation HTTP client for Python, contains a high-severity vulnerability (CVE-2026-84382) that can lead to potential out-of-memory process termination via maliciously crafted network chunks. This issue arises from the library's handling of compressed network data, where a 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation. The vulnerabilit [truncated]
The CVE record describes a local file read vulnerability in pydantic-settings versions from 2.12.0 to 2.14.2. An attacker with influence over the configured secrets directory can read files outside the directory, bypassing the documented size protection. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Users of pydantic-settings, especially those with shared or writable sec [truncated]
CVE-2026-48782 is a medium-severity vulnerability in Pydantic AI, a Python agent framework for building applications and workflows with Generative AI. The issue affects versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2. An attacker can bypass the cloud-metadata blocklist by encoding metadata IP in an IPv6 transition form, exposing cloud IAM short-term credentials. This occurs when an application using [truncated]
CVE-2026-25580 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Pydantic AI, a Python agent framework. The vulnerability allows attackers to make HTTP requests to internal network resources by including malicious URLs in message history from untrusted sources. This could potentially lead to access to internal services or cloud credentials. The vulnerability affects applications that [truncated]
