CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
The Pydantic AI development web chat UI (Agent.to_web(), clai web) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer’s machine, causing the served agent to run and to execute its tools with the privileges and credentials of the local process.
Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer’s browser can reach the loopback address.
References
- github.com/advisories/GHSA-h4xc-3qfq-jf93
- github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46
- github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0
- github.com/pydantic/pydantic-ai/pull/7382
- github.com/pydantic/pydantic-ai/pull/7383
- github.com/pydantic/pydantic-ai/releases/tag/v1.107.4
- github.com/pydantic/pydantic-ai/releases/tag/v2.28.0
- github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93
- nvd.nist.gov/vuln/detail/CVE-2026-107295
Code Behaviors & Features
Detect and mitigate CVE-2026-107295 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →