Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that accepted a share of another project's private workflow create a further membership naming a third project. The new membership row defaults its project_id to the accepting project rather than the workflow owner, so the owner cannot see or delete it. The third project can accept it and then read and execute the owner's private workflow.
Applications using Pydantic AI's local web-fetch tool can suffer excessive CPU and memory use when converting attacker-controlled HTML. Nested block elements make the HTML-to-Markdown conversion reprocess accumulated text at each level, greatly expanding the intermediate output. Provider-native web fetching is not affected.
Fix: Upgrade to a patched release of `pydantic-ai` or `pydantic-ai-slim`. If you cannot upgrade yet, avoid using local web fetching for attacker-controlled HTML.
The Pydantic AI development web chat UI, served through `Agent.to_web()` and `clai web`, does not validate the `Host` header of incoming requests. Using DNS rebinding, a website a developer visits can make the browser treat requests to the local chat UI as same-origin, so the served agent runs and its tools execute with the privileges and credentials of the local process. Binding to localhost, the default, does not prevent this, and current browser protections only partly reduce the exposure.
The Pydantic AI development web chat UI (`Agent.to_web()`, `clai web`) did not check the content type of requests to its chat endpoint. A website visited by a developer could submit a request to the chat UI on that developer's machine, causing the served agent to run and execute its tools with the privileges and credentials of the local process, including tools marked `requires_approval=True`, because the endpoint trusts approval decisions relayed by the client.
Pydantic AI's OpenTelemetry instrumentation records retry prompts that lack an associated tool call in full, even when `InstrumentationSettings(include_content=False)` is set. This affects structured output modes such as `NativeOutput` and `PromptedOutput`, and output validators on text output. Because validation feedback can quote invalid values from the model's response, withheld content can reach the telemetry backend, though it grants no new access to the agent or its data.
Pydantic AI's local web-fetch tool (`web_fetch_tool`, or the `WebFetch` capability's local fallback) and its `FileUrl` media downloads (`ImageUrl`, `DocumentUrl`, `VideoUrl`, `AudioUrl`) read the entire HTTP response body into memory before applying any size limit. An application that exposes the web-fetch tool to untrusted prompts can be driven to fetch a URL that streams a very large body, exhausting process memory and crashing the worker. The issue affects availability only; SSRF protections remain in place and there is no confidentiality or integrity impact.
PraisonAI's SkillTools.run_skill_script() accepts a script_path parameter and executes it via subprocess.run() with no path containment validation, unlike FileTools._validate_path(). An LLM-directed call can therefore run arbitrary scripts from any filesystem location, and the @require_approval decorator can be bypassed via YAML approve: for high-risk tools. Chaining with write_file lets an attacker plant and then execute a script, and because PraisonAI Docker containers run as root, an executed script gains root privileges.
PraisonAI's FastContext feature, in praisonaiagents.context.fast, treats workspace_path as the root for code search but does not confine its model-facing tools to that directory. The execute_tool() method leaves absolute paths unchanged and turns relative traversal paths such as ../outside-secret.txt into paths outside the workspace, and the downstream grep_search, read_file and list_directory functions resolve and read them. A lower-trust prompt or caller that can influence tool arguments can therefore read, search and enumerate files outside the intended project, with the content returned to the caller or injected into the model's tool-result context.
Pydantic AI's local web-fetch tool (`web_fetch_tool`, also the local fallback for the `WebFetch` capability) runs response decoding, title extraction and HTML-to-markdown conversion on the event loop, where several steps take time that grows quadratically with server-controlled input. An attacker who can steer the agent through untrusted prompts can make it fetch a page of one to two megabytes that blocks the event loop for minutes, stalling other agent runs and requests in the process. The fix is in the upgrade listed below.
Pydantic AI's OpenTelemetry instrumentation exports content that `include_content=False` was meant to exclude. Exception events on tool, agent run, model request, embedding, image generation and realtime session spans carry full messages and stack traces, the ERROR status description repeats the exception message, and `model_request_parameters` serializes the agent's instructions and prompted-output template. The exposure affects only whoever can read exported telemetry, which matters when traces go to a broader or less trusted backend.
Pydantic AI's cloud-metadata blocklist can be bypassed by appending an IPv6 zone identifier, such as fd00:ec2::254%251, to a metadata address when local network access is enabled via force_download='allow-local' or web_fetch_tool(allow_local_urls=True). The host ignores the zone identifier on non-link-local destinations, so requests reach the metadata endpoint and can expose cloud IAM short-term credentials. This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, both follow-ups to CVE-2026-25580.
Pydantic AI versions from 1.77.0 up to 1.107.6, and 2.44.0, compare blocked_domains entries against URL hostnames before normalization in the local web_fetch_tool and WebFetch fallback. An attacker-influenced model can use an equivalent spelling, such as an IDNA form, non-ASCII label separator, case variation, or trailing root label, that resolves to a blocked host but fails the string match, so the application fetches that host with its own privileges. allowed_domains fails closed on unmatched spellings, and private-IP and cloud-metadata protections remain effective.
Pydantic AI versions 2.10.0 through 2.53.0 have a flaw in streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency. Because anyio.CapacityLimiter ties an acquired slot to the borrowing task while streaming cleanup can run in a different task, early termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can leave shared concurrency slots occupied. Later requests on the long-lived limiter can then be blocked, causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected.
Ollama's /api/pull endpoint is vulnerable to path traversal because the digestToPath function does not sufficiently validate layer digests. An unauthenticated remote attacker can supply a traversal sequence as a layer digest to write a malicious binary outside the model store. Where the server process can write to /usr/lib/ollama, the file is loaded and executed on the next restart, giving remote code execution as root.
Fix: Fixed in version 0.35.0.
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions. An authenticated user with the LatePoint Agent role, normally limited to their own records, can read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
CVE-2026-82627 affects The Uncanny Automator AI + Automation plugin for WordPress in all versions up to and including 7.6.1.1. The flaw is PHP Object Injection via deserialization of untrusted input, which lets an authenticated user with Subscriber-level access or higher inject a PHP object when a third-party integration plugin such as PeepSo, MailPoet or WPForms is installed and a recipe stores attacker-controlled data as trigger meta. A POP chain within Uncanny Automator allows the attacker to delete arbitrary files on the server.
Flowise versions 3.1.2 and earlier (packages flowise and flowise-components) contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can supply attacker-controlled executablePath and args to puppeteer.launch(), which invokes child_process.spawn() outside the sandbox, enabling arbitrary OS command execution as the Flowise process user (root in the official Docker image) and arbitrary host file disclosure via Chromium's file:// handling. Versions 3.0.8 to 3.1.2 require ALLOW_BUILTIN_DEP=true for exploitation; earlier versions are exploitable by default.
Claude Code checked that a target file path was inside the project working directory at permission-check time, but re-resolved the path at write time without repeating the check. An attacker with write access to the shared workspace who could win a race condition could atomically replace a project file with a symlink, redirecting Claude Code's output to an arbitrary file outside the project sandbox. The flaw let a lower-privileged attacker redirect benign edits to sensitive files, such as shell configuration, in a higher-privileged session.
Users on standard Claude Code auto-update have already received the fix. Users performing manual updates are advised to update to the latest version.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a flaw that allows a remote, authenticated attacker to execute arbitrary OS commands. The flaw stems from improper neutralization of special elements used in an OS command, classified as 'Code Injection' and described as improper control of code generation.
IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by CVE-2026-97673. A remote authenticated attacker could execute arbitrary code because of improper input validation.
Fix: Upgrade `pydantic-ai`/`pydantic-ai-slim` to >= 2.30.0, or to >= 1.107.5 on the v1 maintenance line. The fix validates the `Host` header and rejects anything other than localhost, a loopback/LAN IP address, or an explicitly allowed host, responding `421 Misdirected Request`. If the web chat UI is served under a real hostname, such as behind a reverse proxy or tunnel, name it explicitly with `app = agent.to_web(allowed_hosts=['ui.example.com'])`.
Fix: Upgrade to a patched version. The chat endpoint now requires `Content-Type: application/json` and rejects other requests before the request body is parsed and before the agent runs. Scripts and other non-browser clients calling the endpoint directly may need to send this header. If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when not in use, and don't serve an agent with side-effecting tools through it.
Fix: Upgrade to a patched version; retry prompt content now honors `include_content=False` like all other message content. If unpatched, scrub or drop the message attributes (`gen_ai.input.messages`, `gen_ai.output.messages`, `pydantic_ai.all_messages`) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors `include_content=False`.
GitHub Advisory DatabaseFix: Upgrade to `2.24.0` or later (v2) or `1.107.2` or later (v1). Patched versions enforce a default 50 MiB cap on web-fetch and `FileUrl` downloads while streaming; pass `None` to the limit to restore the previous unbounded behavior.
Fix: Upgrade to a patched version. The title is now found with a single linear scan, the conversion steps run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text.
Fix: Upgrade to a patched version. With `include_content=False`, exception events now record only the exception type, error statuses carry no description, and `model_request_parameters` is exported without its instruction content or output template. If you cannot upgrade, scrub the `exception.message` and `exception.stacktrace` event attributes, the error status description, and the instruction parts and `prompted_output_template` within
GitHub Advisory DatabaseFix: Upgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address. Workaround for unpatched versions: avoid local network access on URLs that untrusted input could influence, or reject URL hosts containing '%' before constructing the FileUrl or configuring the tool.
Fix: This issue is fixed in versions 1.107.6 and 2.44.0.
Fix: Fixed in version 2.53.0.
Fix: Fixed in 3.1.3.
GitHub Advisory Database