CVE-2026-25580: Pydantic AI Server-Side Request Forgery (SSRF) Vulnerability in URL Download Handling

Background

Pydantic AI is a Python library designed for data validation and settings management using Python type annotations. It is widely used in applications that require robust data handling and validation. The library's functionality includes the ability to download content from URLs, which is essential for applications that interact with external resources. However, this feature has a critical vulnerability that allows attackers to exploit the URL download functionality, leading to potential unauthorized access to internal network resources.

Vulnerability Detail

A Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. This vulnerability arises when applications accept message history from untrusted sources, allowing attackers to include malicious URLs. The download_item() function does not validate whether the target URL is a public internet address, enabling attackers to access internal services, steal cloud credentials, and scan internal networks. This vulnerability primarily affects applications that utilize specific integrations or expose custom APIs that accept user input containing URLs.

pip install --upgrade "pydantic-ai==2.60.0"

pip install --upgrade "pydantic-ai==1.56.0"

Workaround

If immediate upgrading is not possible, implement a history processor to filter out URLs targeting local or private addresses. Below is a sample code snippet for the workaround:

import ipaddress import socket from urllib.parse import urlparse from pydantic_ai import Agent, ModelMessage, ModelRequest from pydantic_ai.messages import AudioUrl, DocumentUrl, ImageUrl, VideoUrl

def is_private_url(url: str) -> bool:

try:
    parsed = urlparse(url)
    hostname = parsed.hostname
    if not hostname:

            return True

    ip_str = socket.gethostbyname(hostname)
    ip = ipaddress.ip_address(ip_str)

        return ip.is_private or ip.is_loopback or ip.is_link_local

except (socket.gaierror, ValueError):

        return True

def filter_private_urls(messages: list[ModelMessage]) -> list[ModelMessage]:

url_types = (ImageUrl, AudioUrl, VideoUrl, DocumentUrl)
filtered = []
for msg in messages:
    if isinstance(msg, ModelRequest):
        safe_parts = [
            part for part in msg.parts
            if not (isinstance(part, url_types) and is_private_url(part.url))

            ]

        if safe_parts:
            filtered.append(ModelRequest(parts=safe_parts))
    else:
        filtered.append(msg)

    return filtered

agent = Agent('openai:gpt-5', history_processors=[filter_private_urls])

Conclusion

The SSRF vulnerability in Pydantic AI's URL download handling poses significant risks to applications that accept untrusted user input. It is crucial to upgrade to the patched version to mitigate these risks. If immediate upgrading is not feasible, implementing the provided workaround can help protect against potential exploitation.

See every vulnerability recorded for pydantic-ai →

FAQ