No. 073OSV · 1 source
Pydantic AI web chat UI lets a visited website trigger agent runs
The OSV advisory reports a HIGH-severity flaw in PyPI/pydantic-ai: the development web chat UI did not check request content type, so a website a developer visits can trigger agent runs and server-side tool execution on the local chat endpoint.
On this page
What's on the official record
The OSV advisory reports that the Pydantic AI development web chat UI (Agent.to_web(), clai web) did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute server-side tools on the local chat endpoint.
The advisory is GHSA-h4xc-3qfq-jf93, alias CVE-2026-107295, for the package PyPI/pydantic-ai in the agent_framework layer. The OSV advisory reports severity HIGH, with CWE-346 and CWE-352, and names fixed versions 1.107.4 and 2.28.0. The advisory names no affected version range. The advisory is dated 8 October 2026.
Assessment
For a platform or AI-stack owner, the record lets you check whether any development web chat UI built on pydantic-ai is reachable from a browser session that also loads third-party pages, and whether the served agent can run tools on the host. The advisory names fixed versions 1.107.4 and 2.28.0, so you can decide to patch to those versions or pull the affected development UI until the content-type check is in place.
For a deal team, the record lets you scope diligence on any target that ships or depends on pydantic-ai in a development or agent-serving path. The advisory states the affected package, the severity, and the fixed versions, which you can use to price remediation or condition a transaction on the target confirming it runs a fixed version.
What would change this call
A revised advisory that names an affected version range or a different severity would change the patch priority. A fixed version that the advisory does not yet name would change the remediation path.
What to check next
| Check | Why |
|---|---|
| Whether the served agent can run tools on the host | Determines whether the flaw reaches server-side tool execution |
| Whether the development chat UI is reachable from a browser that loads third-party pages | Determines whether the trigger path is present |
| Whether the deployment runs a fixed version (1.107.4 or 2.28.0) | Determines whether remediation is already applied |
Confidence
Filed 25 October 2026 from the record dated 8 October 2026.
Sources
[1] Pydantic AI Web chat UI (Agent.to_web(), clai web): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint — https://github.com/advisories/GHSA-h4xc-3qfq-jf93
- Entry
- 073
- Published
- Record
- OSV · 1 source
- Written for
AI assistants read this note with get_note cyb-20261008-ghsa-h4xc-3qfq-jf93. Connect yours