# CVE-2026-107295: Pydantic AI missing content-type validation in chat endpoint

Source: https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107295 · Severity: high · CVSS 7.6 · Published 2026-10-08

Pydantic AI's web-based chat interface for agents lacks proper request validation, allowing malicious websites to trigger agent execution and tool invocation on a developer's machine. If a developer runs Agent.to_web() or clai web while visiting an attacker-controlled site, that site can silently invoke the agent and any tools it exposes, potentially leading to data theft or unwanted system changes.

Technologies: [Pydantic AI](https://junglewise.ai/threats/technologies/pydantic-pydantic-ai), [Pydantic AI Slim](https://junglewise.ai/threats/technologies/ai-slim), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107295 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107295 being exploited in the wild.

**How severe is CVE-2026-107295?** High severity, with a CVSS score of 7.6, published 8 October 2026.

**Which products and versions are affected?** Pydantic AI >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0; Pydantic AI Slim >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0; pydantic-ai (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.107.4,introduced=2.0.0b1,fixed=2.28.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.107.4,introduced=2.0.0b1,fixed=2.28.0.

**Is there a fix for CVE-2026-107295?** Yes. pydantic-ai (PyPI): upgrade to 2.28.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.28.0 or later. Until then: The patched versions now require Content-Type: application/json and reject other requests before parsing. If you cannot upgrade, do not run the web UI while browsing untrusted sites, stop it when not in use, and avoid serving agents with side-effecting tools through it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107295 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107295?** Check whether you run Pydantic AI, Pydantic AI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 2.28.0 or later

  ```sh
  pip install "pydantic-ai>=2.28.0"
  ```

- pydantic-ai-slim (PyPI): upgrade to 2.28.0 or later

  ```sh
  pip install "pydantic-ai-slim>=2.28.0"
  ```


The patched versions now require Content-Type: application/json and reject other requests before parsing. If you cannot upgrade, do not run the web UI while browsing untrusted sites, stop it when not in use, and avoid serving agents with side-effecting tools through it.

## Technical details

The chat endpoint does not validate the Content-Type header of incoming requests, enabling cross-origin requests from browser contexts to trigger agent execution. The vulnerability affects Agent.to_web() and clai web endpoints regardless of localhost binding, since browser pages can reach loopback addresses. Tools marked requires_approval=True are also vulnerable because the endpoint trusts client-supplied approval decisions without server-side validation.

## Affected products

- Pydantic Pydantic AI >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0
- Pydantic Pydantic AI Slim >=1.34.0, <1.107.4; >=2.0.0b1, <2.28.0

## Identifiers

- CVE-2026-107295
- GHSA-h4xc-3qfq-jf93
- PYSEC-2026-4278
- PYSEC-2026-4287

## Timeline

- 2026-10-08: disclosed

## References

- [https://api.github.com/users/sondt99](https://api.github.com/users/sondt99)

## Related threats

- [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when)
- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)
- [Pydantic AI unbounded memory use in remote content download](https://junglewise.ai/threats/cve-2026-107294-pydantic-ai-unbounded-memory-use-when-downloading-remote-content)