ReleaseBytes
python Pydantic AI Releases · · 1.107.5

Pydantic-AI 1.107.5 Addresses DNS Rebinding Vulnerability in Web Chat UI

sdksecuritysecurity-advisoryengineerpython-agentic
security

Pydantic-AI version 1.107.5 has been released to fix a critical DNS rebinding vulnerability (GHSA-q2xc-rrxj-58x9) in its local development web chat UI. This flaw allowed malicious websites to potentially access and control local agents through unvalidated Host headers, executing tools with the local process's credentials. The update enhances host header validation, defaulting to local/loopback/LAN addresses, and introduces an `allowed_hosts` setting for deployments using real hostnames. Developers using `Agent.to_web()` or `clai web` are advised to upgrade to mitigate this risk.

Security (1) ›

  • GHSA-q2xc-rrxj-58x9: the local dev web chat UI (Agent.to_web(), clai web) didn't validate the Host header, so DNS rebinding from a website you visit could reach it and run the served agent with your local process's tools and credentials. Fixed in pydantic-ai/pydantic-ai-slim 1.107.5 by validating Host against localhost/loopback/LAN addresses by default; deployments reached under a real hostname must opt in with the new allowed_hosts setting. Backport of allowed_hosts by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7438

Read the original announcement →

https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5

Related releases