ReleaseBytes
python Pydantic AI Releases · · 1.107.4

Pydantic-AI v1.107.4 Addresses High-Severity Web UI Vulnerability

sdkaisecurity-advisoryengineerpython-agentic
security patch

Pydantic-AI v1.107.4 has been released, providing important security and bug fixes for the v1 line. This update resolves a high-severity vulnerability (GHSA-h4xc-3qfq-jf93) in the development web chat UI that could allow cross-origin requests to execute agent tools with local privileges. The fix mandates `Content-Type: application/json` for the chat endpoint and also addresses a low-severity issue where retry-prompt content was not always redacted. These security patches are also available in recent v2 releases, ensuring broader protection for users.

  • →Backport #7357 to v1 by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7381
  • →Only accept JSON request bodies on the web UI chat endpoint (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7383
Security (2) ›

  • GHSA-h4xc-3qfq-jf93 (high) — the development web chat UI's (Agent.to_web(), clai web) chat endpoint didn't check the request's content type, so a plain cross-origin request from a website open in the developer's browser could reach it without a CORS preflight and trigger the served agent to run and execute its tools with the local process's privileges and credentials. The endpoint now requires Content-Type: application/json

  • GHSA-3gh4-cghq-f8v4 (low) — retry-prompt content wasn't redacted by InstrumentationSettings(include_content=False) when the retry wasn't tied to a tool call

Fixes (2) ›
  • Backport #7357 to v1 by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7381
  • Only accept JSON request bodies on the web UI chat endpoint (v1 backport) by @DouweM in https://github.com/pydantic/pydantic-ai/pull/7383
Read the original announcement →

https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4

Related releases