CVE-2026-107295

{
  "etk_id": "ETK-2026-993",
  "cve_id": "CVE-2026-107295",
  "display_id": "CVE-2026-107295",
  "ghsa_id": "GHSA-h4xc-3qfq-jf93",
  "euvd_id": "EUVD-2026-95106",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-site request forgery in Pydantic AI web chat",
  "summary": "Pydantic AI development chat interfaces launched with `Agent.to_web()` or `clai web` are affected. A malicious or untrusted page opened in a developer's browser can cause the locally hosted agent to run and invoke its configured tools with the running process's access. The web UI must be active, and localhost binding alone does not remove this exposure.",
  "mitigation": "Upgrade pydantic-ai to >= 1.107.4, >= 2.28.0; pydantic-ai-slim to >= 1.107.4, >= 2.28.0 or later.",
  "vendor": "pip",
  "product": "pip:pydantic-ai",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.34.0, < 1.107.4"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        ">= 1.107.4"
      ],
      "package_name": "pydantic-ai",
      "purl": "pkg:pypi/pydantic-ai"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0b1, < 2.28.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        ">= 2.28.0"
      ],
      "package_name": "pydantic-ai",
      "purl": "pkg:pypi/pydantic-ai"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.34.0, < 1.107.4"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        ">= 1.107.4"
      ],
      "package_name": "pydantic-ai-slim",
      "purl": "pkg:pypi/pydantic-ai-slim"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0b1, < 2.28.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        ">= 2.28.0"
      ],
      "package_name": "pydantic-ai-slim",
      "purl": "pkg:pypi/pydantic-ai-slim"
    }
  ],
  "cwes": null,
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
  "epss_score": 0.0016,
  "epss_percentile": 0.0455,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.5182598,
  "t0_at": "2026-10-08T17:02:36.718000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T17:02:36.718000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T17:02:36.718000+00:00",
      "url": "https://github.com/advisories/GHSA-h4xc-3qfq-jf93"
    }
  }
}