CVE-2026-114386: Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
(updated )
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.
References
- github.com/advisories/GHSA-3589-pxp7-3gj8
- github.com/pydantic/pydantic-ai/blob/v2.58.0/src/pydantic_ai_harness/pydantic_ai_harness/code_mode/_toolset.py
- github.com/pydantic/pydantic-ai/commit/eb27b2b89fe76ae23ee9b6fc9eb4b227a4967949
- github.com/pydantic/pydantic-ai/pull/10362
- github.com/pydantic/pydantic-ai/releases/tag/v2.59.0
- nvd.nist.gov/vuln/detail/CVE-2026-114386
- pypi.org/project/pydantic-ai-harness/0.59.0
- www.vulncheck.com/advisories/pydantic-ai-harness-before-0.59.0-codemode-tool-call-limit-bypass-via-run-code
Code Behaviors & Features
Detect and mitigate CVE-2026-114386 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →