CSRF in Pydantic Pydantic-Ai
CVE-2026-107295
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Pydantic Pydantic-Ai — versions >= 1.34.0, < 1.107.4, >= 2.0.0b1, < 2.28.0
- Pydantic Pydantic-Ai-Slim — versions >= 1.34.0, < 1.107.4, >= 2.0.0b1, < 2.28.0
Weakness classification (CWE)
References
- github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46
- github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0
- github.com/pydantic/pydantic-ai/pull/7382
- github.com/pydantic/pydantic-ai/pull/7383
- github.com/pydantic/pydantic-ai/releases/tag/v1.107.4
- github.com/pydantic/pydantic-ai/releases/tag/v2.28.0
- github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93
Frequently asked questions
- What is CVE-2026-107295?
- CVE-2026-107295 is a high-severity vulnerability in Pydantic Pydantic-Ai, classified under Cross-Site Request Forgery (CSRF). CVSS score: 7.6/10. Published 2026-10-08.
- How severe is CVE-2026-107295?
- High severity. CVSS v3 base score is 7.6 out of 10.