CVE-2026-107295: any website can make the Pydantic AI web chat UI (Agent.to_web, clai web) run your agent and its tools, upgrade to 1.107.4 or 2.28.0
Pydantic AI's development web chat UI (Agent.to_web() and clai web) didn't check the content type of requests to its chat endpoint. A website open in the developer's browser could send a request to the local UI and make the agent run its tools with the local process's privileges, even when bound to localhost. Tools marked requires_approval=True weren't protected either.
What it is
The chat endpoint accepted requests without requiring Content-Type: application/json, so a cross-site request from any web page could reach it.
Binding to localhost, the default, doesn't help because the page runs in the developer's own browser, which can reach the loopback address.
The served agent then runs and calls its tools with the privileges and credentials of the local process. Depending on the tools, that can mean data disclosure or unwanted side effects.
Tools marked requires_approval=True weren't protected, because the endpoint trusts approval decisions sent by the client.
How to check
- Check your pydantic-ai or pydantic-ai-slim version: 1.34.0 up to 1.107.4, and 2.0.0b1 up to 2.28.0, are affected.
- Check whether you serve agents with Agent.to_web() or clai web, especially agents with tools that write, send or spend.
How to fix
- Upgrade pydantic-ai / pydantic-ai-slim to 1.107.4 (1.x) or 2.28.0 (2.x) or later. The endpoint now rejects requests without Content-Type: application/json.
- If you can't upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve agents with side-effecting tools through it.
- Scripts that call the chat endpoint directly may need to send the Content-Type: application/json header after upgrading.
pip install -U 'pydantic-ai>=1.107.4' # or >=2.28.0 on the 2.x line