« Volver al listado

CVE-2026-107295

Estado: AnalizadaAlta (7.6)—

Pydantic AI es un framework de agentes en Python para crear aplicaciones y flujos de trabajo con IA generativa. Desde la 1.34.0 hasta la 1.107.4 y la 2.28.0, el endpoint de chat de desarrollo web de Agent.to_web() y clai carece de validación del content-type de la solicitud.

Leer descripción completaMostrar menos

Un sitio web visitado por un desarrollador puede enviar una solicitud compatible con el navegador a un servidor de chat alojado en loopback, haciendo que el agente servido se ejecute y ejecute herramientas con los privilegios y credenciales del proceso local; las decisiones de aprobación transmitidas por el cliente también dejan expuestas las herramientas requires_approval=True. Vincularse a localhost no impide que una página del navegador llegue a la dirección de loopback. Este problema está corregido en las versiones 1.107.4 y 2.28.0.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingUser Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Pydantic — Pydantic AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-107295",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107295",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-08T17:53:16.989703Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pydantic",
          "product": "pydantic-ai",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.34.0, < 1.107.4"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0b1, < 2.28.0"
            }
          ]
        },
        {
          "vendor": "pydantic",
          "product": "pydantic-ai-slim",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.34.0, < 1.107.4"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0b1, < 2.28.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T17:17:15.237",
  "references": [
    {
      "url": "https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/commit/dd2abbdfa029c9ad138e7cc0edd2eaeaf9ed69c0",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/pull/7382",
      "tags": [
        "Patch",
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/pull/7383",
      "tags": [
        "Patch",
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0."
    }
  ],
  "lastModified": "2026-10-13T14:16:53.140",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A8C115B-3868-4386-840D-F627698C5C89",
              "versionEndExcluding": "1.107.4",
              "versionStartIncluding": "1.34.0"
            },
            {
              "criteria": "cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87901956-7658-4465-B845-A4A0A2F0E902",
              "versionEndExcluding": "2.28.0",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}