183 matches found
Cross-site Scripting
Pydantic AI is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient validation of a user-controlled version parameter when constructing CDN URLs, allowing path traversal that causes the server to fetch and serve attacker-controlled JavaScript from the CDN, leading to...
pydantic-ai 代码问题漏洞
Pydantic-ai is a generative AI framework developed by Pydantic for building production-level applications and workflows. Pydantic-ai has code vulnerabilities, which stem from overly permissive Deno sandbox configurations. These vulnerabilities may lead to server-side request forgeing attacks...
Pydantic 安全漏洞
Pydantic is an open-source library developed by Pydantic developers. It allows for data validation using Python type hints. Pydantic has a security vulnerability that stems from the lack of isolation between Python code and JavaScript code. This vulnerability could potentially lead to the hijacki...
CVE-2026-25640
A flaw was found in Pydantic AI. A remote attacker can exploit a path traversal vulnerability in the Pydantic AI web UI by crafting a malicious URL. This vulnerability arises from insufficient validation of the version query parameter, allowing the server to fetch and serve attacker-controlled HT...
CVE-2026-25580
A flaw was found in Pydantic AI. This Server-Side Request Forgery SSRF vulnerability allows a remote attacker to include malicious URLs within untrusted message history. When processed by the application, these URLs can force the server to make unauthorized HTTP requests to internal network...
CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources,...
CVE-2026-25580
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources,...
CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources,...
EUVD-2026-5574
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources,...
CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources,...
CVE-2026-25580
Pydantic AI has an SSRF vulnerability in its URL download path. From version 0.0.26 up to, but not including, 1.56.0, untrusted message history can cause the server to fetch URLs that reach internal resources or cloud metadata, exposing internal services or cloud credentials. The issue affects ap...
CVE-2026-25640
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...
CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...
CVE-2026-25640
Pydantic AI (web UI) is affected by CVE-2026-25640 in versions 1.34.0–1.50.x. The vulnerability stems from insufficient validation of the version query parameter used to build the CDN URL for the frontend, allowing path traversal that can cause the server to fetch and serve attacker-controlled HT...
CVE-2026-25640
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...
EUVD-2026-5593
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...
CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...
CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL...
agent-runtimes (=0.0.9), aws-ai-capacity (>=0.1.0 <=0.1.3) +12 more potentially affected by CVE-2026-25640 via pydantic-ai-slim (>=1.34.0 <=1.50.0)
pydantic-ai-slim PYPI version =1.34.0, =0.1.0, =1.3.0, =1.0.0, =0.4.3b0, =1.3.0, =1.3.0, =1.3.0, =0.7.0, =0.45.2, =2.0.0, =2.1.0 Source cves: CVE-2026-25640 Source advisory: SNYK:PYTHON-PYDANTICAISLIM-15248298...
Cross-site Scripting (XSS)
Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Cross-site Scripting XSS via the version query parameter used in constructing the CDN URL for serving frontend HTML. An attacker can execute arbitrary...