Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

PYSEC-2026-4288 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

PYSEC-2026-4278 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

acpkit (>=1.5.0, <=1.6.1), atomicguard (>=1.1.0, <=2.39.1) +3 more potentially affected by CVE-2026-107294 via pydantic-ai (>=2.0.0b1, <=2.23.0)

pydantic-ai PYPI version =2.0.0b1, =1.5.0, =1.1.0, =2.0.0b1, =0.26.0, =0.35.0 Source cves: CVE-2026-107294 Source advisory: OSV:PYSEC-2026-4280...

acpkit (>=1.5.0, <=1.6.1), atomicguard (>=1.1.0, <=2.39.1) +3 more potentially affected by CVE-2026-107293 via pydantic-ai (>=2.0.0b1, <=2.27.0)

pydantic-ai PYPI version =2.0.0b1, =1.5.0, =1.1.0, =2.0.0b1, =0.26.0, =0.35.0 Source cves: CVE-2026-107293 Source advisory: OSV:PYSEC-2026-4274...

acpkit (>=1.5.0, <=1.6.1), atomicguard (>=1.1.0, <=2.39.1) +4 more potentially affected by CVE-2026-107295 via pydantic-ai (>=2.0.0b1, <=2.27.1)

pydantic-ai PYPI version =2.0.0b1, =1.5.0, =1.1.0, =2.0.0b1, =0.7.0rc2, =0.26.0, =0.35.0 Source cves: CVE-2026-107295 Source advisory: OSV:PYSEC-2026-4278...

acpkit (>=1.5.0, <=1.6.1), atomicguard (>=1.1.0, <=2.39.1) +5 more potentially affected by CVE-2026-107292 via pydantic-ai (>=2.0.0b1, <=2.29.0)

pydantic-ai PYPI version =2.0.0b1, =1.5.0, =1.1.0, =2.0.0b1, =0.7.0rc2, =0.1.12, =0.26.0, =0.35.0 Source cves: CVE-2026-107292 Source advisory: OSV:PYSEC-2026-4279...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

PYSEC-2026-4279 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

PYSEC-2026-4287 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

CVE-2026-107295

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.toweb and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

ara-cli (>=0.1.14.13, <=0.1.14.14), auto-browse (>=0.0.2, <=0.0.5) +32 more potentially affected by CVE-2026-107292 via pydantic-ai (>=1.34.0, <=1.107.4)

pydantic-ai PYPI version =1.34.0, =0.1.14.13, =0.0.2, =1.34.0, =1.0.0, =1.0.0, =0.1.102, =26.0.0, =0.2.0, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-107292 Source advisory: SNYK:PYTHON-PYDANTICAI-20848911...

acpkit (>=1.5.0, <=1.6.1), atomicguard (>=1.1.0, <=2.39.1) +5 more potentially affected by CVE-2026-107292 via pydantic-ai (>=2.0.0b1, <=2.29.0)

pydantic-ai PYPI version =2.0.0b1, =1.5.0, =1.1.0, =2.0.0b1, =0.7.0rc2, =0.1.12, =0.26.0, =0.35.0 Source cves: CVE-2026-107292 Source advisory: SNYK:PYTHON-PYDANTICAI-20848911...

ara-cli (>=0.1.14.13, <=0.1.14.14), auto-browse (>=0.0.2, <=0.0.5) +32 more potentially affected by CVE-2026-107292 via pydantic-ai (>=1.34.0, <=1.107.4)

pydantic-ai PYPI version =1.34.0, =0.1.14.13, =0.0.2, =1.34.0, =1.0.0, =1.0.0, =0.1.102, =26.0.0, =0.2.0, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-107292 Source advisory: GHSA-Q2XC-RRXJ-58X9...

GHSA-Q2XC-RRXJ-58X9 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

acpkit (>=1.5.0, <=1.6.1), atomicguard (>=1.1.0, <=2.39.1) +5 more potentially affected by CVE-2026-107292 via pydantic-ai (>=2.0.0b1, <=2.29.0)

pydantic-ai PYPI version =2.0.0b1, =1.5.0, =1.1.0, =2.0.0b1, =0.7.0rc2, =0.1.12, =0.26.0, =0.35.0 Source cves: CVE-2026-107292 Source advisory: GHSA-Q2XC-RRXJ-58X9...

DNS Rebinding

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to DNS Rebinding via insufficient Host header validation in the web UI component Agent.toweb and the clai web command. A malicious website can point a...