PT-2026-127742

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web fetch or URL-based knowledge import to reach...

PYSEC-2026-4290 Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

PT-2026-108045

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.5 Pydantic AI versions prior to 2.44.0 Description The local web fetch tool and the WebFetch local fallback process server-controlled responses using operations that grow quadratically relative to the...

PT-2026-108033

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.5 Pydantic AI versions prior to 2.44.0 Description The local web fetch tool and the WebFetch local fallback compare blocked domains entries with a URL hostname before both values are normalized to the...

PT-2026-108676

Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool web fetch tool, or the WebFetch capability's local fallback to untrusted prompts can be driven to...

PT-2026-108054

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.1 Pydantic AI versions prior to 2.24.0 Description Certain remote-content download paths buffer the entire HTTP response body into memory before enforcing content-size controls. This occurs when using...

PT-2026-108032

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.6 Pydantic AI versions prior to 2.52.0 Description The local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during the conversion of HTML to Markdown. This occurs...

PT-2026-108654

Summary The local web-fetch tool web fetch tool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...

PT-2026-108677

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...

PYSEC-2026-4116 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

EUVD-2026-75187

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets...

CVE-2026-88001

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-87999

Open WebUI (a self-hosted AI platform) had a server-side request forgery (SSRF) vulnerability in backend/open_webui/retrieval/web/utils.py, affecting the POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search endpoints. The root cause was that Python's globally routable ...

CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

PT-2026-83086

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1 Description Server-side request forgery SSRF exists in the http request and web fetch agent tools. The issue occurs because DNS resolution is performed only during the guard phase without validating the resolutio...

Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

MAL-2026-12996 Malicious code in bnpl-blocks-mobile-bnpl-link-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6203d02c8bfb651950b571dd342ff82e154a3c3867af751a7fb1facdb5bd0f5 On require of the package, support.js selects a platform-specific asset path and fetches a binary over HTTPS from obfuscated .workers.dev hosts...

Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

Malicious code in cobrowsing-k8s-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join""...