HIGH8.6PyPI
GHSA-2jrp-274c-jhv3· CVE-2026-25580, PYSEC-2026-2976Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Modified: 7/13/2026
package
PyPI/pydantic-ai
pkg:pypi/pydantic-ai
MEDIUM6.8PyPI
GHSA-cg7w-rg45-pc59· CVE-2026-48782, PYSEC-2026-2977pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Modified: 7/13/2026
MEDIUM6.8PyPI
GHSA-cqp8-fcvh-x7r3· CVE-2026-46678, PYSEC-2026-2978Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Modified: 7/13/2026
MEDIUM6.8PyPI
GHSA-h7p7-w5gc-xj3w· CVE-2026-54249, PYSEC-2026-3692Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Modified: 8/19/2026
HIGH7.1PyPI
GHSA-wjp5-868j-wqv7· CVE-2026-25640, PYSEC-2026-2979Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
Modified: 7/13/2026
HIGH8.6PyPI
PYSEC-2026-2976· CVE-2026-25580, GHSA-2jrp-274c-jhv3Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Modified: 7/13/2026
MEDIUM6.8PyPI
PYSEC-2026-2977· CVE-2026-48782, GHSA-cg7w-rg45-pc59pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Modified: 7/13/2026
MEDIUM6.8PyPI
PYSEC-2026-2978· CVE-2026-46678, GHSA-cqp8-fcvh-x7r3Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Modified: 7/13/2026
HIGH7.1PyPI
PYSEC-2026-2979· CVE-2026-25640, GHSA-wjp5-868j-wqv7Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
Modified: 7/13/2026
MEDIUM6.8PyPI
PYSEC-2026-3692· CVE-2026-54249, GHSA-h7p7-w5gc-xj3wPydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Modified: 8/19/2026