CVE-2026-25640: Pydantic AI web UI path traversal via version query parameter

Summary

Pydantic AI versions from 1.34.0 before 1.51.0 contain a path traversal flaw in the web UI. The version query parameter in the CDN URL is not validated, so a crafted URL makes the server fetch and serve attacker-controlled HTML/JavaScript from another location on the same CDN. Only applications using Agent.to_web or clai web are affected, and an attacker who lures a victim into clicking the link or loading it in an iframe can run code in the victim's browser and steal chat history and other client-side data.

Mitigation

Fixed in 1.51.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• pydantic-aiPyPILLM dependency since 2024-05-20 · 4 tracked dependents
• pydantic-ai-slimPyPILLM dependency since 2024-11-25 · 7 tracked dependents

Topics

• AI agents

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online