Is CVE-2026-107295 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107295 being exploited in the wild.

How severe is CVE-2026-107295?

High severity, with a CVSS score of 7.6, published 8 October 2026.

Which products and versions are affected?

Pydantic AI >=1.34.0, =2.0.0b1, =1.34.0, =2.0.0b1, <2.28.0; pydantic-ai (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.107.4,introduced=2.0.0b1,fixed=2.28.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.107.4,introduced=2.0.0b1,fixed=2.28.0.

How is CVE-2026-107295 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107295?

Check whether you run Pydantic AI, Pydantic AI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107295: Pydantic AI missing content-type validation in chat endpoint

Q: Is there a fix for CVE-2026-107295?

Yes. pydantic-ai (PyPI): upgrade to 2.28.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.28.0 or later. Until then: The patched versions now require Content-Type: application/json and reject other requests before parsing. If you cannot upgrade, do not run the web UI while browsing untrusted sites, stop it when not in use, and avoid serving agents with side-effecting tools through it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107295 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107295?

Check whether you run Pydantic AI, Pydantic AI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107295 · Severity: high · CVSS 7.6 · Published 2026-10-08

Pydantic AI's web-based chat interface for agents lacks proper request validation, allowing malicious websites to trigger agent execution and tool invocation on a developer's machine. If a developer runs Agent.to_web() or clai web while visiting an attacker-controlled site, that site can silently invoke the agent and any tools it exposes, potentially leading to data theft or unwanted system changes.

Technologies: Pydantic AI, Pydantic AI Slim, pydantic-ai (PyPI), pydantic-ai-slim (PyPI). Vendors: Pydantic, PyPI.

Quick answers

Is CVE-2026-107295 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107295 being exploited in the wild.
How severe is CVE-2026-107295?: High severity, with a CVSS score of 7.6, published 8 October 2026.
Which products and versions are affected?: Pydantic AI >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0; Pydantic AI Slim >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0; pydantic-ai (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.107.4,introduced=2.0.0b1,fixed=2.28.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.107.4,introduced=2.0.0b1,fixed=2.28.0.
Is there a fix for CVE-2026-107295?: Yes. pydantic-ai (PyPI): upgrade to 2.28.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.28.0 or later. Until then: The patched versions now require Content-Type: application/json and reject other requests before parsing. If you cannot upgrade, do not run the web UI while browsing untrusted sites, stop it when not in use, and avoid serving agents with side-effecting tools through it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107295 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107295?: Check whether you run Pydantic AI, Pydantic AI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pydantic-ai (PyPI): upgrade to 2.28.0 or later
```
pip install "pydantic-ai>=2.28.0"
```
pydantic-ai-slim (PyPI): upgrade to 2.28.0 or later
```
pip install "pydantic-ai-slim>=2.28.0"
```

The patched versions now require Content-Type: application/json and reject other requests before parsing. If you cannot upgrade, do not run the web UI while browsing untrusted sites, stop it when not in use, and avoid serving agents with side-effecting tools through it.

Technical details

The chat endpoint does not validate the Content-Type header of incoming requests, enabling cross-origin requests from browser contexts to trigger agent execution. The vulnerability affects Agent.to_web() and clai web endpoints regardless of localhost binding, since browser pages can reach loopback addresses. Tools marked requires_approval=True are also vulnerable because the endpoint trusts client-supplied approval decisions without server-side validation.

Affected products

Pydantic Pydantic AI >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0
Pydantic Pydantic AI Slim >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0

Identifiers

CVE-2026-107295
GHSA-h4xc-3qfq-jf93
PYSEC-2026-4278
PYSEC-2026-4287

Timeline

2026-10-08: disclosed

References

https://api.github.com/users/sondt99

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.