CVE-2026-25640: 
PydanticAI vulnerability analysis and mitigation

CVE-2026-25640 is a stored XSS via path traversal vulnerability in the Pydantic AI web UI, affecting the Python agent framework used for building Generative AI applications and workflows. The flaw exists in pydantic-ai and pydantic-ai-slim versions >= 1.34.0 and < 1.51.0. It was disclosed on February 6, 2026, via a GitHub Security Advisory (GHSA-wjp5-868j-wqv7). The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, Pydantic Advisory).

The root cause is a combination of CWE-22 (Path Traversal) and CWE-79 (Cross-Site Scripting). The Pydantic AI web UI serves its frontend HTML by fetching it from a CDN, and in affected versions, the CDN URL is constructed using a version query parameter taken directly from the incoming HTTP request without any validation or sanitization. An attacker can inject path traversal sequences (e.g., ../) into this parameter, causing the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary location on the same CDN instead of the legitimate chat UI package. This results in stored XSS execution in the victim's browser context when they visit the crafted URL. The vulnerability only affects deployments using Agent.to_web or the clai web CLI command to serve the chat interface (Pydantic Advisory, Github Advisory).

Successful exploitation allows attacker-controlled JavaScript to execute in the victim's browser within the context of the Pydantic AI web application. This grants access to chat history stored in localStorage (including all user messages and AI responses) and potentially session cookies not configured as HttpOnly if authentication middleware is in use. While availability is unaffected, the confidentiality impact is rated High due to the potential exposure of sensitive AI conversation data, and integrity is rated Low due to the ability to manipulate the rendered page content (Pydantic Advisory, Github Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.019% (0.000140), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — the victim must click a crafted link or visit a page embedding a malicious iframe — but requires no authentication or special privileges from the attacker (Github Advisory).

1. Reconnaissance: Identify a target running Pydantic AI versions 1.34.0–1.50.x with Agent.to_web or clai web exposed, either on localhost (with a known port) or on a remote server.
2. Craft malicious URL: Construct a URL pointing to the victim's Pydantic AI web UI endpoint, appending a version query parameter containing path traversal sequences (e.g., ?version=../../attacker-controlled-package) that redirect the CDN fetch to attacker-controlled content.
3. Host malicious payload: Place a crafted HTML/JavaScript file at the CDN path that the traversal sequence resolves to, designed to exfiltrate localStorage data (chat history) or steal session cookies.
4. Deliver the link: Send the crafted URL to the victim via phishing, redirect, or embed it in an iframe on an attacker-controlled page.
5. Achieve code execution: When the victim's browser loads the page, the server fetches and serves the attacker's HTML/JavaScript, which executes in the Pydantic AI application context, exfiltrating chat history and any accessible session cookies to an attacker-controlled endpoint (Pydantic Advisory, Github Advisory).

• Network: HTTP requests to the Pydantic AI web UI endpoint containing a version query parameter with path traversal sequences (e.g., ../, %2e%2e%2f); outbound CDN fetch requests from the server to unexpected package paths or non-standard CDN URLs.
• Logs: Web server access logs showing GET requests to the chat UI endpoint with unusual or encoded version parameter values; server-side logs indicating CDN fetches to unexpected resource paths.
• Browser/Client-Side: Unexpected outbound network requests from the victim's browser to attacker-controlled domains shortly after visiting the Pydantic AI UI; localStorage access patterns inconsistent with normal application behavior.

Upgrade pydantic-ai and pydantic-ai-slim to version 1.51.0 or later, which removes the user-controllable version query parameter entirely and hardcodes the CDN URL at startup. Applications requiring a custom UI source can use the new html_source parameter on Agent.to_web or create_web_app, which is only configurable in application code and not via request parameters. As an interim measure, restrict access to the Pydantic AI web UI to trusted networks or localhost only, and avoid exposing it publicly (Pydantic Advisory, v1.51.0 Release).

The advisory was published by Pydantic maintainer DouweM on February 6, 2026, and credited three external security researchers (doredry, urioren, amiteliahu) as finders. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (Pydantic Advisory).