Junglewise Threat Intelligence

CVE-2026-25640: Pydantic AI path traversal and XSS in web UI

CVE-2026-25640 · Severity: high · CVSS 7.1 · Published 2026-02-06

Technologies: pydantic-ai (PyPI), Red Hat Enterprise Linux AI (RHEL AI) 3, pydantic-ai-slim (PyPI), Pydantic AI Slim, PydanticAI. Vendors: PyPI, Red Hat, Pydantic.

Executive brief

Pydantic AI is a framework used to build applications powered by Generative AI. A security flaw in its web-based chat interface allows attackers to trick the system into loading malicious code from an external source. If a user clicks a specially crafted link, an attacker could steal sensitive information, such as private chat histories and session data.

Technical details

A path traversal vulnerability (CWE-22) and resulting Cross-Site Scripting (XSS) (CWE-79) exist in the Pydantic AI web UI. The application constructs a CDN URL using an unvalidated 'version' query parameter from the request. An attacker can use path traversal sequences in this parameter to force the server to fetch and serve malicious HTML or JavaScript from an arbitrary location on the same CDN. Exploitation requires a victim to visit a crafted URL or interact with a malicious iframe, allowing the attacker to execute code in the victim's browser context and access localStorage data, including chat history. The issue is fixed in version 1.51.0 by hardcoding the CDN URL.

Affected products

  • pydantic pydantic-ai >= 1.34.0, < 1.51.0
  • pydantic pydantic-ai-slim >= 1.34.0, < 1.51.0
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

Timeline

  • 2026-01-30: patched: Version 1.51.0 released
  • 2026-02-06: advisory: GitHub Advisory GHSA-wjp5-868j-wqv7 published
  • 2026-02-06: disclosed: CVE-2026-25640 published

References

Related threats