{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "pydantic-ai: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/pydantic--pydantic-ai/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/pydantic--pydantic-ai/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107295/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107295/",
   "title": "CVE-2026-107295 · pydantic-ai · disclosed",
   "content_text": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.",
   "date_published": "2026-10-08T17:02:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107295/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107295/",
   "title": "CVE-2026-107295 · pydantic-ai · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pydantic-ai 1.107.4, pydantic-ai 2.28.0, pydantic-ai-slim 1.107.4, pydantic-ai-slim 2.28.0.",
   "date_published": "2026-10-08T17:02:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107286/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107286/",
   "title": "CVE-2026-107286 · pydantic-ai · disclosed",
   "content_text": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.",
   "date_published": "2026-10-08T15:12:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107286/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107286/",
   "title": "CVE-2026-107286 · pydantic-ai · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pydantic-ai 2.53.0, pydantic-ai-slim 2.53.0.",
   "date_published": "2026-10-08T15:12:26Z"
  }
 ]
}