pydantic-ai-slim

AI Agent Framework, the Pydantic way

View on Pypi

View on Github

Activity

Latest release: 1d ago
Total releases: 294
Cadence: ~daily
Last 12 months: 187

Reach

Stars: 18.9k

Details

License: MIT
First release: Nov 25, 2024

Releases

Version	Released
`2.21.0` minor	Jul 30, 2026
`2.20.0` minor	Jul 29, 2026
`2.19.0` minor	Jul 28, 2026
`2.18.0` minor	Jul 25, 2026
`2.17.0` minor	Jul 24, 2026
`2.16.0` minor	Jul 23, 2026
`2.15.0` minor	Jul 22, 2026
`2.14.1` patch	Jul 21, 2026
`2.14.0` minor	Jul 21, 2026
`2.13.0` minor	Jul 18, 2026
`2.12.0` minor	Jul 17, 2026
`2.11.0` minor	Jul 16, 2026
`2.10.0` minor	Jul 15, 2026
`2.9.1` patch	Jul 14, 2026
`1.107.1` patch	Jul 11, 2026
`2.9.0` minor	Jul 11, 2026
`2.8.0` minor	Jul 10, 2026
`2.7.0` minor	Jul 09, 2026
`2.6.0` minor	Jul 08, 2026
`2.5.1` patch	Jul 07, 2026
`2.5.0` minor	Jul 04, 2026
`2.4.0` minor	Jul 03, 2026
`2.3.0` minor	Jul 02, 2026
`2.2.0` minor	Jul 01, 2026
`2.1.0` minor	Jun 29, 2026
`2.0.0` major	Jun 23, 2026
`2.0.0b7` pre	Jun 10, 2026
`1.107.0` minor	Jun 10, 2026
`2.0.0b6` pre	Jun 05, 2026
`1.106.0` minor	Jun 05, 2026
`2.0.0b5` pre	Jun 02, 2026
`1.105.0` minor	Jun 02, 2026
`2.0.0b4` pre	May 29, 2026
`1.104.0` minor	May 29, 2026
`1.103.0` minor	May 27, 2026
`2.0.0b3` pre	May 23, 2026
`1.102.0` minor	May 23, 2026
`2.0.0b2` pre 1 CVE	May 22, 2026
`1.101.0` minor 1 CVE	May 22, 2026
`2.0.0b1` pre 1 CVE	May 21, 2026
`1.100.0` minor 1 CVE	May 21, 2026
`1.99.0` minor 1 CVE	May 20, 2026
`1.98.0` minor 2 CVEs	May 19, 2026
`1.97.0` minor 2 CVEs	May 15, 2026
`1.96.1` patch 2 CVEs	May 15, 2026
`1.96.0` minor 2 CVEs	May 14, 2026
`1.95.1` patch 2 CVEs	May 13, 2026
`1.95.0` minor 2 CVEs	May 13, 2026
`1.94.0` minor 2 CVEs	May 12, 2026
`1.93.0` minor 2 CVEs	May 09, 2026

1–50 of 294

Repository

pydantic/pydantic-ai

Forks: 2.4k
Open issues: 420
Language: Python

agent-framework
pydantic
python
genai
llm

Dependencies (42)

Depends on

2.21.0

ag-ui-protocol >=0.1.10
anthropic >=0.108.0
argcomplete >=3.5.0
boto3 >=1.42.63
botocore >=1.42.63
cohere >=5.20.6
dbos >=2.10.0
ddgs >=9.0.0
exa-py >=2.0.0
exceptiongroup >=1.2.2

1–10 of 42

Used by

1–10 of 21

Supply-chain exposure

21 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

CVE-2026-48782 PYSEC-2026-2981 GHSA-cg7w-rg45-pc59 PYSEC-2026-2977 Jul 13, 2026

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

6.8 / 10
Medium
Network High None None Changed High None None

Summary

When an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs) and runs on a network that routes the affected IPv6 transition forms (NAT64- or ISATAP-configured networks), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous fix did not decode — IPv4-compatible IPv6 (::a.b.c.d), the NAT64 RFC 8215 local-use prefix (64:ff9b:1::/48), operator-chosen NAT64 prefixes, or ISATAP. The IPv6 wrapper is then delivered to the underlying IPv4 metadata endpoint, exposing cloud IAM short-term credentials.

The bypass is exploitable only in environments whose network actually routes these forms — NAT64-configured networks (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or networks with an ISATAP tunnel for ISATAP. A standard dual-stack cloud VM or container does not route them and is not affected in practice. The IPv4-compatible and Teredo variants are deprecated and addressed as defense-in-depth.

This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 (itself a follow-up to CVE-2026-25580). The prior remediation decoded only IPv4-mapped IPv6, 6to4, and the NAT64 well-known prefix; the metadata guarantee did not hold for the remaining transition forms.

Severity

MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N = 6.8

Same impact metrics and narrow attack surface as the parent advisory (AC:H): exploitation requires the application to have opted into allow-local on a URL influenced by untrusted input, and the NAT64/ISATAP variants additionally require the deployment network to route those forms.

CWE-918: Server-Side Request Forgery (SSRF)

Affected Versions

| Package | Vulnerable | Patched | |---|---|---| | pydantic-ai | >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3 | 1.102.0; 2.0.0b3 | | pydantic-ai-slim | >= 1.56.0, < 1.102.0; >= 2.0.0b1, < 2.0.0b3 | 1.102.0; 2.0.0b3 |

These transition forms have not been decoded since SSRF protection was introduced in 1.56.0.

Who Is Affected

Users are affected only if their application explicitly opts a FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL that is, or could be, influenced by untrusted input.

Beyond that precondition, the affected encodings only reach a metadata endpoint in environments whose network actually routes them. The broadly-routable IPv4-mapped form was addressed in 1.99.0 (CVE-2026-46678); the additional forms addressed here require a NAT64-configured network (IPv6-only or dual-stack-with-NAT64 deployments, including some Kubernetes setups) for the NAT64 variants, or an ISATAP tunnel for the ISATAP variant. The IPv4-compatible and Teredo forms are deprecated and not routed by modern stacks; they are addressed as defense-in-depth. Most deployments on a standard dual-stack cloud VM or container are therefore not exploitable in practice, but the fix restores the "always blocked" guarantee for the environments that are.

Users are not affected if they use any of the bundled integrations to ingest user input, because they do not propagate force_download from external data:

Agent.to_web / clai web

VercelAIAdapter

AGUIAdapter / Agent.to_ag_ui

Applications that only download from developer-controlled URLs are not affected.

Remediation

Upgrade to 1.102.0 or later (or 2.0.0b3 or later on the 2.0 pre-release line). The cloud-metadata and private-IP blocklists now decode the embedded IPv4 of every standardized IPv6 transition form before evaluating it — IPv4-mapped, IPv4-compatible, 6to4, NAT64 across all prefix lengths (including the RFC 8215 local-use prefix and operator-chosen prefixes), ISATAP, and Teredo. The set of always-blocked cloud metadata/credential endpoints has also been expanded across providers.

Workaround for Unpatched Versions

Avoid passing force_download='allow-local' on any URL that could be influenced by untrusted input. If developers must, resolve the hostname themselves and validate the result against their own metadata blocklist — including IPv6 transition forms — before constructing the FileUrl.

Credits

Reported by @SnailSploit.

Affected versions

1.100.01.101.01.56.01.57.01.58.01.59.01.60.01.61.01.62.01.63.01.64.01.65.0

+ 42 more Show less

1.66.01.67.01.68.01.69.01.70.01.71.01.72.01.73.01.74.01.75.01.76.01.77.01.78.01.79.01.80.01.81.01.82.01.83.01.84.01.84.11.85.01.85.11.86.01.86.11.87.01.88.01.89.01.89.11.90.01.91.01.92.01.93.01.94.01.95.01.95.11.96.01.96.11.97.01.98.01.99.02.0.0b12.0.0b2

Fixed in

1.102.02.0.0b3

References

https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cg7w-rg45-pc59
https://nvd.nist.gov/vuln/detail/CVE-2026-48782
https://github.com/pydantic/pydantic-ai/pull/5596
https://github.com/pydantic/pydantic-ai/commit/1add06179ba4de259f7ab977620b697b7209f7e4
https://github.com/pydantic/pydantic-ai
https://github.com/pydantic/pydantic-ai/releases/tag/v1.102.0

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-46678 PYSEC-2026-2982 GHSA-cqp8-fcvh-x7r3 PYSEC-2026-2978 Jul 13, 2026

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

6.8 / 10
Medium
Network High None None Changed High None None

Summary

When an application using Pydantic AI opts a URL into force_download='allow-local' (which disables the default block on private/internal IPs), the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form (IPv4-mapped IPv6, 6to4, or NAT64). Dual-stack and translated networks route the IPv6 wrapper to the underlying IPv4 endpoint, exposing cloud IAM short-term credentials.

This is an incomplete fix of GHSA-2jrp-274c-jhv3 / CVE-2026-25580. The parent advisory's remediation guaranteed that "cloud metadata endpoints are always blocked, even with allow-local." That guarantee did not hold for IPv6-encoded forms of the metadata IPs.

Severity

Same impact metrics as the parent CVE, but materially narrower attack surface (AC:H instead of AC:L), because exploitation requires the application to have opted into allow-local on a URL influenced by untrusted input.

Who Is Affected

Applications are affected only if they explicitly opt for FileUrl (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) into force_download='allow-local' on a URL that is, or could be, influenced by untrusted input.

Applications are not affected if they use any of the bundled integrations to ingest user input, because they do not propagate force_download from external data:

Agent.to_web / clai web

VercelAIAdapter

AGUIAdapter / Agent.to_ag_ui

Applications that only download from developer-controlled URLs are not affected.

Remediation

Upgrade to 1.99.0 or later. The cloud-metadata and private-IP blocklists now apply to IPv6 transition forms that route to a blocked IPv4 endpoint (IPv4-mapped IPv6, 6to4, and NAT64 well-known prefix). The blocklists have also been extended to cover additional IANA-reserved IPv4 and IPv6 special-purpose ranges.

Workaround for Unpatched Versions

Avoid passing force_download='allow-local' on any URL that could be influenced by untrusted input. If developers must, resolve the hostname themselves and validate the result against their own metadata blocklist — including IPv6-encoded forms — before constructing the FileUrl.

Credits

Reported by j0hndo.

Affected versions

1.56.01.57.01.58.01.59.01.60.01.61.01.62.01.63.01.64.01.65.01.66.01.67.0

+ 37 more Show less

1.68.01.69.01.70.01.71.01.72.01.73.01.74.01.75.01.76.01.77.01.78.01.79.01.80.01.81.01.82.01.83.01.84.01.84.11.85.01.85.11.86.01.86.11.87.01.88.01.89.01.89.11.90.01.91.01.92.01.93.01.94.01.95.01.95.11.96.01.96.11.97.01.98.0

Fixed in

1.99.0

References

https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-cqp8-fcvh-x7r3
https://github.com/pydantic/pydantic-ai
https://pypi.org/project/pydantic-ai-slim
https://github.com/advisories/GHSA-cqp8-fcvh-x7r3
https://nvd.nist.gov/vuln/detail/CVE-2026-46678

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-25640 PYSEC-2026-2983 GHSA-wjp5-868j-wqv7 PYSEC-2026-2979 Jul 13, 2026

Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

7.1 / 10
High
Network Low None Required Unchanged High Low None

Summary

A Path Traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data.

This vulnerability only affects applications that use:

Agent.to_web to serve a chat interface

clai web to serve a chat interface from the CLI

These are typically run locally (on localhost), but may also be deployed on a remote server.

Description

The web UI serves its frontend HTML by fetching it from a CDN. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package.

Who Is Affected

Projects are affected if your application uses Agent.to_web or clai web to serve the Pydantic AI chat interface.

Attack Scenario

An attacker crafts a URL pointing to the victim's Pydantic AI web UI instance (either localhost with the known port, or a remote server endpoint) with a malicious version query parameter containing path traversal sequences.

The attacker gets the victim to visit this URL — directly via a link, through a redirect, or by embedding it in an iframe.

When the victim's browser loads the page, the server fetches and serves attacker-controlled HTML/JavaScript instead of the legitimate chat UI.

The attacker's JavaScript executes in the victim's browser in the context of the Pydantic AI web application, with access to:

Chat history stored in localStorage (all user messages and AI responses)

Session cookies that are not set as HttpOnly, if authentication middleware is configured

Remediation

Upgrade to Patched Version

Upgrade to the patched version or later. The fix removes the user-controllable version parameter entirely. The CDN URL is now hardcoded at startup and cannot be influenced by request parameters.

A new html_source parameter is available on Agent.to_web and create_web_app for applications that need to customize the UI source (e.g., for enterprise environments, offline usage, or custom UI builds). This parameter is only settable in application code, not via query parameters.

Affected versions

1.34.01.35.01.36.01.37.01.38.01.39.01.39.11.40.01.41.01.42.01.43.01.44.0

+ 5 more Show less

1.46.01.47.01.48.01.49.01.50.0

Fixed in

1.51.0

References

https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-wjp5-868j-wqv7
https://nvd.nist.gov/vuln/detail/CVE-2026-25640
https://github.com/pydantic/pydantic-ai
https://github.com/pydantic/pydantic-ai/releases/tag/v1.51.0
https://pypi.org/project/pydantic-ai-slim
https://github.com/advisories/GHSA-wjp5-868j-wqv7

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-25580 PYSEC-2026-2980 GHSA-2jrp-274c-jhv3 PYSEC-2026-2976 Jul 13, 2026

Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

8.6 / 10
High
Network Low None None Changed High None None

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials.

This vulnerability only affects applications that accept message history from external users, such as those using:

Agent.to_web or clai web to serve a chat interface

VercelAIAdapter for Vercel AI SDK integration

AGUIAdapter or Agent.to_ag_ui for AG-UI protocol integration

Custom APIs that accept message history from user input

Applications that only use hardcoded or developer-controlled URLs are not affected.

Description

The download_item() helper function downloads content from URLs without validating that the target is a public internet address. When user-supplied message history contains URLs, attackers can:

Access internal services: Request http://127.0.0.1, localhost, or private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)

Steal cloud credentials: Access cloud metadata endpoints (AWS IMDSv1 at 169.254.169.254, GCP, Azure, Alibaba Cloud)

Scan internal networks: Enumerate internal hosts and ports

Who Is Affected

You are affected if your application:

Uses Agent.to_web or clai web - The web interface accepts file attachments via the Vercel AI Data Stream Protocol, where users can provide arbitrary URLs through chat messages.

Uses VercelAIAdapter - Chat interfaces built with Vercel AI SDK allow users to submit messages containing URLs that are processed server-side.

Uses AGUIAdapter or Agent.to_ag_ui - The AG-UI protocol allows users to provide file references with URLs as part of agent interactions.

Exposes a custom API accepting message history - Any endpoint that accepts message history or ImageUrl, AudioUrl, VideoUrl, DocumentUrl objects from user input.

Attack Scenario

Via chat interface, an attacker submits a message with a file attachment pointing to an internal resource:

{ "role": "user", "parts": [ {"type": "file", "mediaType": "image/png", "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"} ] }

Affected Model Integrations

Multiple model integrations download URL content in certain conditions:

| Provider | Downloaded Types | |----------|------------------| | OpenAIChatModel | AudioUrl, DocumentUrl | | AnthropicModel | DocumentUrl (text/plain) | | GoogleModel (GLA) | All URL types (except YouTube and Files API URLs) | | XaiModel | DocumentUrl | | BedrockConverseModel | ImageUrl, DocumentUrl, VideoUrl (non-S3 URLs) | | OpenRouterModel | AudioUrl |

Remediation

Upgrade to Patched Version

Upgrade to the patched version or later. The fix adds comprehensive SSRF protection:

Blocks private/internal IP addresses by default

Always blocks cloud metadata endpoints (even with allow-local)

Only allows http:// and https:// protocols

Resolves hostnames before requests to prevent DNS rebinding

Validates each redirect target

New force_download='allow-local' Option

If an application legitimately needs to access local/private network resources (e.g., in a fully trusted internal environment), it can explicitly opt in:

from pydantic_ai import ImageUrl # Default behavior: private IPs are blocked ImageUrl(url="http://internal-service/image.png") # Raises ValueError # Opt-in to allow local access (use with caution) ImageUrl(url="http://internal-service/image.png", force_download='allow-local')

Important: Cloud metadata endpoints (169.254.169.254, fd00:ec2::254, 100.100.100.200) are always blocked, even with allow-local.

Workaround for Older Versions

If a project cannot upgrade immediately, use a history processor to filter out URLs targeting local/private addresses:

import ipaddress import socket from urllib.parse import urlparse from pydantic_ai import Agent, ModelMessage, ModelRequest from pydantic_ai.messages import AudioUrl, DocumentUrl, ImageUrl, VideoUrl def is_private_url(url: str) -> bool: """Check if a URL targets a private/internal IP address.""" try: parsed = urlparse(url) hostname = parsed.hostname if not hostname: return True # Invalid URL, block it # Resolve hostname to IP ip_str = socket.gethostbyname(hostname) ip = ipaddress.ip_address(ip_str) # Block private, loopback, and link-local addresses return ip.is_private or ip.is_loopback or ip.is_link_local except (socket.gaierror, ValueError): return True # DNS resolution failed, block it def filter_private_urls(messages: list[ModelMessage]) -> list[ModelMessage]: """Remove URL parts that target private/internal addresses.""" url_types = (ImageUrl, AudioUrl, VideoUrl, DocumentUrl) filtered = [] for msg in messages: if isinstance(msg, ModelRequest): safe_parts = [ part for part in msg.parts if not (isinstance(part, url_types) and is_private_url(part.url)) ] if safe_parts: filtered.append(ModelRequest(parts=safe_parts)) else: filtered.append(msg) return filtered # Apply the filter to your agent agent = Agent('openai:gpt-5', history_processors=[filter_private_urls])

Technical Details of the Fix

The fix introduces a new _ssrf.py module with comprehensive protection:

Protocol validation: Only http:// and https:// allowed

DNS resolution before request: Prevents DNS rebinding attacks

Private IP blocking (by default):

127.0.0.0/8, ::1/128 (loopback)

10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (private)

169.254.0.0/16, fe80::/10 (link-local)

100.64.0.0/10 (CGNAT)

fc00::/7 (unique local)

2002::/16 (6to4, can embed private IPv4)

Cloud metadata always blocked: 169.254.169.254, fd00:ec2::254, 100.100.100.200

Safe redirect handling: Each redirect validated before following (max 10)

Affected versions

0.0.260.0.270.0.280.0.290.0.300.0.310.0.320.0.330.0.340.0.350.0.360.0.37

+ 167 more Show less

0.0.380.0.390.0.400.0.410.0.420.0.430.0.440.0.450.0.460.0.470.0.480.0.490.0.500.0.510.0.520.0.530.0.540.0.550.1.00.1.10.1.100.1.110.1.120.1.20.1.30.1.40.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.170.2.180.2.190.2.20.2.200.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.70.4.00.4.10.4.100.4.110.4.20.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.10.6.00.6.10.6.20.7.00.7.10.7.20.7.30.7.40.7.50.7.60.8.00.8.11.0.01.0.0b11.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.10.01.11.01.11.11.12.01.13.01.14.01.14.11.15.01.16.01.17.01.18.01.19.01.2.01.2.11.20.01.21.01.22.01.23.01.24.01.25.01.25.11.26.01.27.01.28.01.29.01.3.01.30.01.30.11.31.01.32.01.33.01.34.01.35.01.36.01.37.01.38.01.39.01.39.11.4.01.40.01.41.01.42.01.43.01.44.01.46.01.47.01.48.01.49.01.5.01.50.01.51.01.52.01.53.01.54.01.55.01.6.01.7.01.8.01.9.01.9.1

Fixed in

1.56.0

References

https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3
https://nvd.nist.gov/vuln/detail/CVE-2026-25580
https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301
https://github.com/pydantic/pydantic-ai
https://pypi.org/project/pydantic-ai-slim
https://github.com/advisories/GHSA-2jrp-274c-jhv3

Updated Jul 13, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 2
minor 135
patch 144
pre 12

294 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More