Skip to content
OpenAdvisories

Vendor

pydantic

24 known vulnerabilities.

Products

pydantic-ai 16 pydantic-ai-slim 14 httpx2 5 Pydantic 1 pydantic-ai-harness 1 pydantic-settings 1 httpcore2 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2026-107295

    `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

    Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited …

    pydantic pydantic-ai pydantic-ai-slim pydantic-ai PyPI
  • High 7.5
    CVE-2026-107286

    Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

    Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.C…

    pydantic pydantic-ai pydantic-ai-slim pydantic-ai PyPI
  • High 7.5
    CVE-2026-84382

    HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the ap…

    pydantic httpx2 httpx2 python-httpx2 Debian Ubuntu Wolfi PyPI
  • High 8.1
    CVE-2026-84381

    HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because …

    pydantic httpx2 httpcore2 httpx2 Ubuntu PyPI
  • High 8.6
    CVE-2026-25580

    Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

    Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept me…

    pydantic pydantic-ai pydantic-ai-slim pydantic-ai PyPI
  • High 7.1
    CVE-2026-25640

    Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

    Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the a…

    pydantic pydantic-ai pydantic-ai-slim pydantic-ai PyPI