CVE-2026-25640: Pydantic AI Path Traversal Vulnerability

CVE-2026-25640 Overview

CVE-2026-25640 is a path traversal vulnerability in Pydantic AI, a Python agent framework used for building applications and workflows with Generative AI. The vulnerability exists in the Pydantic AI web UI component from versions 1.34.0 to before 1.51.0, allowing attackers to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. This vulnerability enables theft of chat history and other client-side data when victims interact with malicious links.

Critical Impact

Attackers can execute arbitrary JavaScript in users' browsers through crafted URLs, potentially stealing sensitive chat history and client-side data from Pydantic AI web interfaces.

Affected Products

• Pydantic AI versions 1.34.0 to 1.50.x
• Applications using Agent.to_web to serve chat interfaces
• CLI applications using clai web to serve chat interfaces

Discovery Timeline

• 2026-02-06 - CVE-2026-25640 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25640

Vulnerability Analysis

This path traversal vulnerability (CWE-22) affects the Pydantic AI web UI's CDN URL construction mechanism. The vulnerability stems from improper input validation of the version query parameter used to build CDN URLs. An attacker can exploit this by injecting path traversal sequences into the version parameter, causing the server to fetch and serve attacker-controlled HTML or JavaScript content from an arbitrary source on the same CDN instead of the legitimate chat UI package.

The attack requires user interaction—victims must click a malicious link or visit it via an iframe. Once triggered, attacker-controlled code executes within the victim's browser context, providing access to sensitive application data including chat history.

Root Cause

The root cause is insufficient validation of the version query parameter from the request URL. The application directly uses this parameter to construct CDN URLs without sanitizing path traversal sequences such as ../. This allows attackers to manipulate the URL path and redirect resource fetching to arbitrary locations within the CDN infrastructure.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL containing path traversal sequences in the version query parameter. When a victim accesses this URL—either by clicking a link or through an embedded iframe—the Pydantic AI web UI fetches and serves attacker-controlled JavaScript from an unexpected CDN location. This JavaScript then executes in the victim's browser with full access to the application context.

While these applications are typically run locally on localhost, they may also be deployed on remote servers, expanding the potential attack surface. The vulnerability specifically affects deployments using Agent.to_web or the clai web CLI command.

Detection Methods for CVE-2026-25640

Indicators of Compromise

• Unusual URL patterns containing path traversal sequences (../) in version query parameters
• Web server logs showing requests with manipulated CDN URLs or unexpected resource paths
• Client-side JavaScript execution from unexpected CDN sources
• Reports of unauthorized access to chat history or session data

Detection Strategies

• Monitor web application logs for requests containing path traversal patterns (../, ..%2F, etc.) in query parameters
• Implement Content Security Policy (CSP) headers to restrict JavaScript execution sources
• Deploy web application firewalls (WAF) with rules to detect and block path traversal attempts
• Review network traffic for anomalous CDN resource requests originating from Pydantic AI applications

Monitoring Recommendations

• Enable detailed logging for all Pydantic AI web interface requests
• Set up alerts for unusual patterns in version query parameters
• Monitor for unauthorized data exfiltration attempts from client browsers
• Regularly audit CSP configurations and JavaScript resource origins

How to Mitigate CVE-2026-25640

Immediate Actions Required

• Upgrade Pydantic AI to version 1.51.0 or later immediately
• Audit existing deployments using Agent.to_web or clai web for exposure
• Implement strict Content Security Policy headers to limit JavaScript sources
• Review access logs for evidence of exploitation attempts

Patch Information

The vulnerability has been fixed in Pydantic AI version 1.51.0. Organizations should upgrade to this version or later to remediate the vulnerability. Detailed patch information is available in the GitHub Release v1.51.0 and the GitHub Security Advisory GHSA-wjp5-868j-wqv7.

Workarounds

• Restrict network access to Pydantic AI web interfaces to trusted users only
• Implement a reverse proxy with URL validation to filter malicious requests before they reach the application
• Deploy Web Application Firewall rules to block requests containing path traversal sequences
• Disable public-facing deployments of Agent.to_web or clai web until patching is complete

# Upgrade Pydantic AI to the patched version
pip install --upgrade pydantic-ai>=1.51.0

# Verify the installed version
pip show pydantic-ai | grep Version