dbcve.org
Pydantic AiApplication · Pydantic

CVE-2026-25640

MEDIUM · 5.4 CVSS v3.1 Published 2026-02-06
Fix available
A fix is available. Upgrade to 1.51.0 or later.
See remediation →
61/100
Remediation priority · Elevated
Remotely reachable No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 to before 1.51.0, a path traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data. This vulnerability only affects applications that use Agent.to_web to serve a chat interface and clai web to serve a chat interface from the CLI. These are typically run locally (on localhost), but may also be deployed on a remote server. This vulnerability is fixed in 1.51.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Path traversal vulnerability in Pydantic AI's web UI allows attackers to manipulate the version query parameter when constructing CDN URLs. Since this parameter isn't validated, attackers can inject path traversal sequences to serve malicious JavaScript from arbitrary CDN sources, executing in victims' browsers to steal chat history and client-side data.

MitigationUpgrade Pydantic AI to version 1.51.0 or later to obtain the patched version. If upgrading is not immediately possible, avoid exposing the web UI (Agent.to_web or clai web) to untrusted networks.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Pydantic AiApplication
Affected:>= 1.34.0, < 1.51.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check if Pydantic AI is installed
    Run `pip show pydantic-ai` or check your project dependencies for the pydantic-ai package
    Affected if The package is present in the environment
  2. Determine installed Pydantic AI version
    Run `pip show pydantic-ai` and note the Version field, or check your lock file for the pydantic-ai version
    Affected if Version is >= 1.34.0 and < 1.51.0
  3. Check for web UI usage in codebase
    Search your codebase for calls to `Agent.to_web` method or usage of the `clai web` CLI command, and inspect any web UI configuration
    Affected if The web UI is enabled or exposed in the application code
  4. Verify web UI network exposure
    Review your deployment configuration, firewall rules, and network ACLs to determine if the web UI endpoint is accessible from untrusted networks
    Affected if The web UI is exposed to untrusted or public networks

You are affected if Pydantic AI version is >= 1.34.0 and < 1.51.0 AND the web UI (Agent.to_web or clai web) is enabled and accessible.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.51.0 or later
Fixed in 1.51.0
Interim mitigation

Upgrade Pydantic AI to version 1.51.0 or later to obtain the patched version. If upgrading is not immediately possible, avoid exposing the web UI (Agent.to_web or clai web) to untrusted networks.

Recommended fix High confidence

1.51.0

  1. 1. Identify all Pydantic AI deployments running versions >= 1.34.0 and < 1.51.0 that use Agent.to_web or the clai web CLI command
  2. 2. Upgrade Pydantic AI to version 1.51.0 or later using your package manager (e.g., pip install pydantic-ai==1.51.0 or pip install --upgrade pydantic-ai)
  3. 3. Verify the upgrade was successful by checking the installed version (pip show pydantic-ai)
  4. 4. Redeploy any affected services with the updated version
  5. 5. Test the web UI functionality (Agent.to_web or clai web) to ensure the upgrade did not break existing features

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Pydantic Ai Scoped from the published advisory
  • Consultation1.0 h
  • Implementation1.0 h
  • Testing4.0 h
  • Review / QA2.0 h
8.0 hours of engineering $1,340
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,144.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-25640 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-25640 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data