# CVE-2026-25640: Pydantic AI path traversal and XSS in web UI

Source: https://junglewise.ai/threats/cve-2026-25640-pydantic-ai-path-traversal-and-xss-in-web-ui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-25640 · Severity: high · CVSS 7.1 · Published 2026-02-06

Pydantic AI is a framework used to build applications powered by Generative AI. A security flaw in its web-based chat interface allows attackers to trick the system into loading malicious code from an external source. If a user clicks a specially crafted link, an attacker could steal sensitive information, such as private chat histories and session data.

Technologies: [PydanticAI](https://junglewise.ai/threats/technologies/pydanticai), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-25640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25640 being exploited in the wild.

**How severe is CVE-2026-25640?** High severity, with a CVSS score of 7.1, published 6 February 2026.

**Which products and versions are affected?** PydanticAI >= 1.34.0, < 1.51.0; PydanticAI Slim >= 1.34.0, < 1.51.0; pydantic-ai (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.51.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.34.0,fixed=1.51.0.

**Is there a fix for CVE-2026-25640?** Yes. pydantic-ai (PyPI): upgrade to 1.51.0 or later; pydantic-ai-slim (PyPI): upgrade to 1.51.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25640 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25640?** Check whether you run PydanticAI, PydanticAI Slim, pydantic-ai (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 1.51.0 or later

  ```sh
  pip install "pydantic-ai>=1.51.0"
  ```

- pydantic-ai-slim (PyPI): upgrade to 1.51.0 or later

  ```sh
  pip install "pydantic-ai-slim>=1.51.0"
  ```


## Technical details

A path traversal vulnerability (CWE-22) and resulting Cross-Site Scripting (XSS) (CWE-79) exist in the Pydantic AI web UI. The application constructs a CDN URL using an unvalidated 'version' query parameter from the request. An attacker can use path traversal sequences in this parameter to force the server to fetch and serve malicious HTML or JavaScript from an arbitrary location on the same CDN. Exploitation requires a victim to visit a crafted URL or interact with a malicious iframe, allowing the attacker to execute code in the victim's browser context and access localStorage data, including chat history. The issue is fixed in version 1.51.0 by hardcoding the CDN URL.

## Affected products

- pydantic pydantic-ai >= 1.34.0, < 1.51.0
- pydantic pydantic-ai-slim >= 1.34.0, < 1.51.0
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

## Identifiers

- CVE-2026-25640
- GHSA-wjp5-868j-wqv7
- PYSEC-2026-2979
- PYSEC-2026-2983

## Timeline

- 2026-01-30: patched: Version 1.51.0 released
- 2026-02-06: advisory: GitHub Advisory GHSA-wjp5-868j-wqv7 published
- 2026-02-06: disclosed: CVE-2026-25640 published

## References

- [https://github.com/pydantic/pydantic-ai/releases/tag/v1.51.0](https://github.com/pydantic/pydantic-ai/releases/tag/v1.51.0)
- [https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-wjp5-868j-wqv7](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-wjp5-868j-wqv7)
- [https://access.redhat.com/security/cve/CVE-2026-25640](https://access.redhat.com/security/cve/CVE-2026-25640)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2437753](https://bugzilla.redhat.com/show_bug.cgi?id=2437753)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25640.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25640.json)

## Related threats

- [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when)
- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)