adguard-home-agent (>=0.2.15, <=0.15.0), agent-utilities (>=3.0.0, <=3.2.0) +88 more potentially affected by CVE-2026-114386 via pydantic-ai-harness (>=0.1.2, <=0.58.0)

pydantic-ai-harness PYPI version =0.1.2, =0.2.15, =3.0.0, =2.7.0, =1.3.15, =0.1.0, =0.4.0, =0.1.15, =0.1.0, =0.1.6, =0.6.16, =0.1.0, =0.30.0, =0.3.0, =0.1.0, =1.0.0, =2.0.1 and more Source cves: CVE-2026-114386 Source advisory: GHSA-3589-PXP7-3GJ8...

Pydantic AI Harness tool-call limit bypass in nested CodeMode calls

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-114386

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

adguard-home-agent (>=0.2.15, <=0.15.0), agent-utilities (>=3.0.0, <=3.2.0) +88 more potentially affected by CVE-2026-114386 via pydantic-ai-harness (>=0.1.2, <=0.58.0)

pydantic-ai-harness PYPI version =0.1.2, =0.2.15, =3.0.0, =2.7.0, =1.3.15, =0.1.0, =0.4.0, =0.1.15, =0.1.0, =0.1.6, =0.6.16, =0.1.0, =0.30.0, =0.3.0, =0.1.0, =1.0.0, =2.0.1 and more Source cves: CVE-2026-114386 Source advisory: MEND:CVE-2026-114386...

CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

EUVD-2026-107233

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-114386 Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

CVE-2026-114386

The Pydantic AI Harness (versions before 0.59.0 ) contains a vulnerability in the CodeMode toolset where it fails to enforce UsageLimits.tool_calls_limit on nested tool calls. Specifically, when run_code is used, the sandboxed program can invoke tools via run_nested_call() without triggering the ...

CVE-2026-114386

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall without checkbeforetoolcall, exceeding operator limits...

PT-2026-122414

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool calls limit on nested tool calls dispatched from run code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run nested call without check before tool call, exceeding operato...

PT-2026-120573

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool calls limit on nested tool calls dispatched from run code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run nested call without check before tool call, exceeding operato...

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. SummaryApplications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one th...

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. SummaryApplications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one th...

PYSEC-2026-4285 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

PYSEC-2026-4276 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

a13n-harness (0.0.3), a13n-stream-protocol (0.0.3) +72 more potentially affected by CVE-2026-107286 via pydantic-ai-slim (>=2.10.0, <=2.52.0)

pydantic-ai-slim PYPI version =2.10.0, =1.5.0, =0.1.0, =0.1.0, =2.1.0, =0.3.0, =0.0.0, =0.0.0, =0.1.9.62, =0.2.1, =0.2.2 - bonsai-core 0.1.0 and more Source cves: CVE-2026-107286 Source advisory: OSV:PYSEC-2026-4285...

acpkit (>=1.5.0, <=1.10.0), aer1-all (>=0.1.0, <=0.1.2) +33 more potentially affected by CVE-2026-107286 via pydantic-ai (>=2.10.0, <=2.52.0)

pydantic-ai PYPI version =2.10.0, =1.5.0, =0.1.0, =0.1.0, =2.1.0, =0.3.0, =0.1.9.62, =0.2.1, =2.10.0, =5.1.0, =0.1.8, =0.1.0, =0.1.0, =0.8.0 and more Source cves: CVE-2026-107286 Source advisory: OSV:PYSEC-2026-4276...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

SummarySeveral remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fetc...