ReleaseBytes
python Pydantic AI Releases · · 1.107.3

Pydantic AI v1.107.3 Patches High-Severity Web Chat UI Vulnerability

sdksecuritysecurity-advisoryengineerpython-agentic
security patch

Pydantic AI v1.107.3 delivers two critical security backports to the v1 line, addressing significant vulnerabilities. A high-severity flaw in the development web chat UI (`Agent.to_web()`) allowed plain cross-origin requests to trigger agent tool execution with local privileges, now mitigated by requiring `Content-Type: application/json`. Additionally, a low-severity issue where retry-prompt content was not redacted by `InstrumentationSettings(include_content=False)` has been fixed. These updates enhance the security and privacy of Pydantic AI's development tools and instrumentation.

  • →Backport #7357 to v1 by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7381
  • →Only accept JSON request bodies on the web UI chat endpoint (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7383
Security (2) ›

  • GHSA-h4xc-3qfq-jf93 (high) — the development web chat UI's (Agent.to_web(), clai web) chat endpoint didn't check the request's content type, so a plain cross-origin request from a website open in the developer's browser could reach it without a CORS preflight and trigger the served agent to run and execute its tools with the local process's privileges and credentials. The endpoint now requires Content-Type: application/json

  • GHSA-3gh4-cghq-f8v4 (low) — retry-prompt content wasn't redacted by InstrumentationSettings(include_content=False) when the retry wasn't tied to a tool call

Fixes (2) ›
  • Backport #7357 to v1 by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7381
  • Only accept JSON request bodies on the web UI chat endpoint (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7383
Read the original announcement →

https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.3

Related releases