Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed.
Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Не требуются
Права не нужны
Участие пользователя
Требуется
Нужно действие пользователя
Последствия
Конфиденциальность
Низкое
Частичная утечка данных
Целостность
Высокое
Полная модификация данных
Доступность
Низкое
Частичное нарушение работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Ссылки 7
https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed9…
security-advisories@github.com
https://github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaea…
security-advisories@github.com
https://github.com/pydantic/pydantic-ai/pull/7382
security-advisories@github.com
https://github.com/pydantic/pydantic-ai/pull/7383
security-advisories@github.com
https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4
security-advisories@github.com
https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0
security-advisories@github.com
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93
security-advisories@github.com