High 7.6Published Oct 8, 2026

CVE-2026-107295`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects pydantic-ai and 2 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.16%, higher than 4% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for pydantic-ai

Exploited in the last 30 days

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.

CVSS: 7.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Weakness (CWE): CWE-352
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.16% (percentile 4)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

pydantic pydantic-ai pydantic:ai (from the name)	from 1.34.0, < 1.107.4; from 2.0.0b1, < 2.28.0	CNA record
pydantic pydantic-ai-slim pydantic:ai_slim (from the name)	from 1.34.0, < 1.107.4; from 2.0.0b1, < 2.28.0	CNA record
pydantic pydantic_ai pydantic:pydantic_ai	from 1.34.0 before 1.107.4; from 2.0.0 before 2.28.0	NVD

References

https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93x-refsource-confirm, mitigation, vendor-advisory
https://github.com/pydantic/pydantic-ai/pull/7382x-refsource-misc, patch, issue-tracking
https://github.com/pydantic/pydantic-ai/pull/7383x-refsource-misc, patch, issue-tracking
https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46x-refsource-misc, patch
https://github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0x-refsource-misc, patch
https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4x-refsource-misc, patch, release-notes
https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0x-refsource-misc, patch, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.