CVE-2026-25640: Pydantic AI Stored XSS via Path Traversal in Web UI CDN URL
Summary
CVE-2026-25640: Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL. Affects pydantic-ai versions >= 1.34.0, < 1.51.0. Fixed in 1.51.0. How to fix ↓
Also tracked for
- pydantic-ai-slim · PyPI
The same CVE-2026-25640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic AI is an open-source framework designed for data validation and settings management using Python type annotations. It provides a web UI for chat interfaces, allowing users to interact with AI models seamlessly. However, a critical vulnerability has been identified that affects the security of applications utilizing this framework, particularly those that serve chat interfaces via specific methods.
Vulnerability Detail
A Path Traversal vulnerability exists in the Pydantic AI web UI, allowing attackers to manipulate the version query parameter in the URL. This manipulation can lead to the server fetching and serving malicious HTML/JavaScript from an arbitrary source on the CDN instead of the legitimate chat UI package. As a result, when a victim accesses the crafted URL, the attacker's code executes in the victim's browser, potentially leading to theft of sensitive data such as chat history and session cookies.
How To Fix
Minimum fixed version
1.51.0
This is the first release that contains the fix.
pip install --upgrade "pydantic-ai==1.51.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The Pydantic AI vulnerability CVE-2026-25640 poses a significant risk to applications using its web UI. It is crucial for developers to upgrade to the patched version to mitigate the risk of exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for pydantic-ai →
FAQ
The vulnerability is a Path Traversal issue that allows attackers to serve malicious JavaScript in the context of the Pydantic AI web application.
If your application uses Agent.to_web or clai web to serve the Pydantic AI chat interface, it is likely affected by this vulnerability.
Attackers can execute arbitrary JavaScript in the victim's browser, leading to the theft of chat history and session cookies.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic-ai.
