CVE-2026-25640
📋 TL;DR
A path traversal vulnerability in Pydantic AI's web UI allows attackers to serve malicious JavaScript by crafting URLs with unvalidated version parameters. This enables client-side code execution in victims' browsers, potentially stealing chat history and other data. Only applications using Agent.to_web or CLI web interfaces are affected, typically running locally but possibly deployed remotely.
💻 Affected Systems
- Pydantic AI
📦 What is this software?
Pydantic Ai by Pydantic
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of client-side data including chat history, session tokens, and sensitive information entered in the chat interface via malicious JavaScript execution.
Likely Case
Theft of chat history and client-side data from users who click malicious links or visit compromised interfaces.
If Mitigated
Limited impact if application runs in isolated environments without sensitive data or user interaction.
🎯 Exploit Status
Exploitation requires crafting malicious URLs but no authentication; user interaction needed for successful attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.51.0
Vendor Advisory: https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-wjp5-868j-wqv7
Restart Required: Yes
Instructions:
1. Update Pydantic AI: pip install --upgrade pydantic-ai==1.51.0
2. Restart any running applications using Pydantic AI web interfaces
3. Verify the update with: pip show pydantic-ai
🔧 Temporary Workarounds
Disable Web Interfaces
allTemporarily disable Agent.to_web() and CLI web interfaces until patching is possible.
Modify code to remove or comment out Agent.to_web() calls
Avoid using 'pydantic-ai web' CLI command
Network Isolation
allRestrict access to web interfaces to trusted networks only.
Configure firewall rules to limit access to localhost/trusted IPs
Use reverse proxy with strict URL validation
🧯 If You Can't Patch
- Deploy web interfaces only on isolated networks with no internet access
- Implement strict input validation at the application layer to sanitize version parameters
🔍 How to Verify
Check if Vulnerable:
Check if using Pydantic AI version 1.34.0-1.50.x AND using Agent.to_web() or CLI web interfaces.Check Version:
pip show pydantic-ai | grep VersionVerify Fix Applied:
Confirm Pydantic AI version is 1.51.0 or higher and test web interfaces with malicious URL patterns.📡 Detection & Monitoring
Log Indicators:
- Unusual URL patterns with path traversal sequences in version parameters
- Requests to unexpected CDN URLs
Network Indicators:
- HTTP requests containing '../' or similar sequences in query parameters
- Unexpected JavaScript file loads from CDN
SIEM Query:
web.url:*version=*../* OR web.url:*%2e%2e%2f*