{"data":{"id":"0c8c812f-2b3d-4786-9df2-cb76f35bfdc2","title":"GHSA-v36g-jcw9-x7cw: Pydantic AI: Excessive resource use when local web fetching converts nested HTML","summary":"Applications using Pydantic AI's local web-fetch tool can suffer excessive CPU and memory use when converting attacker-controlled HTML. Nested block elements make the HTML-to-Markdown conversion reprocess accumulated text at each level, greatly expanding the intermediate output. Provider-native web fetching is not affected.","solution":"Upgrade to a patched release of `pydantic-ai` or `pydantic-ai-slim`. If you cannot upgrade yet, avoid using local web fetching for attacker-controlled HTML.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-v36g-jcw9-x7cw","publishedAt":"2026-10-08T17:40:50.000Z","cveId":"CVE-2026-107287","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["pydantic-ai-slim@>= 2.0.0b1, < 2.52.0 (fixed: 2.52.0)","pydantic-ai-slim@>= 1.77.0, < 1.107.7 (fixed: 1.107.7)","pydantic-ai@>= 2.0.0b1, < 2.52.0 (fixed: 2.52.0)","pydantic-ai@>= 1.77.0, < 1.107.7 (fixed: 1.107.7)"],"affectedPackageNames":["pydantic-ai-slim","pydantic-ai"],"affectedVendors":[],"affectedVendorsRaw":["Pydantic AI","pydantic-ai","pydantic-ai-slim"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00277,"epssCheckedAt":"2026-10-10T03:00:37.160Z","kevDateAdded":null,"advisoryAliases":["GHSA-v36g-jcw9-x7cw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-08T17:40:50.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}