{
 "schema_version": "0.4",
 "id": "REG-0027",
 "title": "Pydantic AI: a web page can make a developer's local agent run and execute tools, including tools marked as requiring approval, fixed August 2026",
 "batch": "agent-2026-10-12",
 "family": "software",
 "context": {
  "domain": "Software agent (agent framework, local development chat server)",
  "autonomy_level": "alone",
  "autonomy_level_text": "The served agent runs and calls tools on a request with no human deciding it",
  "actor_type": "Software: an agent served by Agent.to_web() or the clai web chat in Pydantic AI",
  "actors": {
   "count": 1,
   "text": "1 agent; attacker as a web page",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure; no exploitation reported",
  "jurisdiction": [
   "Global (open-source framework)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "Maintainer advisory published through the GitHub CNA and recorded in NVD, with fix commits and releases",
 "status": "confirmed",
 "status_text": "Confirmed (fixed; no exploitation reported)",
 "outcome": {
  "state": "averted_by_disclosure",
  "severity": "none reported; the maintainer's advisory rates the flaw High, 7.6 on version 3.1 of the Common Vulnerability Scoring System (CVSS, a severity score); the National Vulnerability Database (NVD) carries this score from GitHub, the CVE Numbering Authority, and added none of its own",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "A developer running a Pydantic AI agent locally through Agent.to_web() or the clai web development chat",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "Serve a local chat interface for developing and testing an agent",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "The agent served by the local chat endpoint, holding the privileges and credentials of the local process",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "A request submitted by a website the developer visits, to the loopback-hosted chat server; the endpoint did not validate the request content type",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA",
    "NVD-107295"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "authority",
   "value": "The agent's tools ran with the privileges and credentials of the local process; binding to localhost did not prevent a browser page from reaching it",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "Tools marked requires_approval remained exposed because approval decisions were relayed by the client",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "The served agent runs and executes tools on the attacker's request",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: averted by disclosure. No exploitation reported. As of Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "GHSA",
    "NVD-107295"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Maintainer advisory GHSA-h4xc-3qfq-jf93, published on the project's repository on 12 August 2026 and in the GitHub Advisory Database on 8 October 2026; NVD record CVE-2026-107295 published 8 October 2026. The advisory classifies the weakness as origin validation error (Common Weakness Enumeration CWE-346) and cross-site request forgery (CWE-352); the NVD record lists only CWE-352.",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA",
    "NVD-107295"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Fixed in versions 1.107.4 and 2.28.0, released on 12 August 2026, via pull requests 7382 and 7383 (merged 11 August 2026), which make the chat endpoint refuse requests not sent as JavaScript Object Notation (JSON). A companion advisory on the same chat endpoint, GHSA-q2xc-rrxj-58x9, found that versions with this fix could still be reached from a web page by Domain Name System (DNS) rebinding because the server did not check the Host header; that was fixed in 1.107.5 and 2.30.0, released on 14 August 2026.",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA",
    "NVD-107295",
    "FIX-7382",
    "REL-2-28-0",
    "REL-1-107-4",
    "GHSA-Q2XC"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "Coordinated disclosure through the maintainer's security advisory, which credits Thai Son Dinh of VinSOC Labs (research and development) as the reporter",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  }
 ],
 "inference": {
  "value": "The maintainer's own documentation says the chat server trusts whatever approval decision the client sends, so any client that can reach the endpoint can approve a pending tool call, and calls approval prompts a convenience for the developer rather than an authorization control. The August 2026 fixes kept that design and instead stopped web pages from reaching the endpoint: it now accepts only requests sent as JavaScript Object Notation (JSON), which a browser will not send to another site without a permission check the server refuses, and, after a second fix two days later, only requests addressed to localhost, an Internet Protocol (IP) address, or an explicitly allowed host name. The record does not show exploitation, a public proof of concept, or harm to any developer.",
  "source_ids": [
   "GHSA",
   "FIX-7382",
   "GHSA-Q2XC",
   "FIX-7437"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "controls": {
  "failed": [
   {
    "id": "C-E3",
    "note": "Client-relayed approval left requires_approval tools exposed",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-A1",
    "note": "Request origin not verified (no content-type validation)",
    "confidence": "high",
    "basis": "agent"
   }
  ],
  "succeeded": [
   {
    "id": "C-O1",
    "note": "Coordinated disclosure and fix",
    "confidence": "high",
    "basis": "agent"
   }
  ],
  "absent": [
   {
    "id": "C-E1",
    "note": "Tools ran with the full privileges and credentials of the local process",
    "confidence": "medium",
    "basis": "agent"
   }
  ]
 },
 "applicable_rules": [
  "None applicable; maintainer security policy"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "Pydantic",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "acknowledged": "2026-10-15",
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [],
      "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own"
     }
    ]
   }
  }
 ],
 "sources": {
  "GHSA": {
   "title": "Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93)",
   "type": "company",
   "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93",
   "date": "2026-08-12",
   "tier": "disclosure_corroborated",
   "interest": null
  },
  "NVD-107295": {
   "title": "NVD record CVE-2026-107295 (CNA: GitHub), CVSS 3.1 7.6, CWE-352",
   "type": "standards_body",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107295",
   "date": "2026-10-08",
   "tier": "disclosure_corroborated",
   "interest": null
  },
  "FIX-7382": {
   "title": "Only accept JSON request bodies on the web UI chat endpoint (#7382) (Pydantic AI commit d2690201)",
   "type": "company",
   "url": "https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46",
   "date": "2026-08-11",
   "tier": "disclosure_corroborated",
   "interest": "vendor describing its own fix",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "REL-2-28-0": {
   "title": "v2.28.0 (2026-08-11) (Pydantic AI release)",
   "type": "company",
   "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0",
   "date": "2026-08-12",
   "tier": "disclosure_corroborated",
   "interest": "vendor describing its own release",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "REL-1-107-4": {
   "title": "v1.107.4 (2026-08-11) (Pydantic AI release)",
   "type": "company",
   "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4",
   "date": "2026-08-12",
   "tier": "disclosure_corroborated",
   "interest": "vendor describing its own release",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "GHSA-Q2XC": {
   "title": "Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (Pydantic AI security advisory GHSA-q2xc-rrxj-58x9)",
   "type": "company",
   "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9",
   "date": "2026-08-14",
   "tier": "disclosure_corroborated",
   "interest": "vendor describing its own product",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "FIX-7437": {
   "title": "Add `allowed_hosts` to `Agent.to_web()` and `clai web` (#7437) (Pydantic AI commit 871c7aee)",
   "type": "company",
   "url": "https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7",
   "date": "2026-08-13",
   "tier": "disclosure_corroborated",
   "interest": "vendor describing its own fix",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-14",
   "field": "reviewed_by",
   "old": "none",
   "new": "Saurabh Bhatnagar (editor)",
   "reason": "case checked by the editor against its linked records"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Pydantic].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to security@pydantic.dev on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-15",
   "field": "named_parties[Pydantic].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"acknowledged\": \"2026-10-15\"}",
   "reason": "Pydantic acknowledged receipt of the right-of-reply letter by email to the editor on 15 October 2026 and said it had passed the letter to its open-source team for review; no statement yet. The acknowledgment is not published as a statement. Recorded at the editor's instruction"
  },
  {
   "date": "2026-10-21",
   "field": "title",
   "old": "Pydantic AI: a web page can make a developer's local agent run and execute tools, including tools marked as requiring approval, fixed October 2026",
   "new": "Pydantic AI: a web page can make a developer's local agent run and execute tools, including tools marked as requiring approval, fixed August 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the fix shipped in August, not October. The maintainer's release pages show v2.28.0 'released this 12 Aug' and v1.107.4 'released this 12 Aug' (both headed 2026-08-11), and the repository advisory GHSA-h4xc-3qfq-jf93 was published on 12 August 2026; October 2026 is when the CVE (Common Vulnerabilities and Exposures) record and the GitHub Advisory Database entry were published (8 October)."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 3.1 base 7.6)",
   "new": "none reported; the maintainer's advisory rates the flaw High, 7.6 on version 3.1 of the Common Vulnerability Scoring System (CVSS, a severity score); the National Vulnerability Database (NVD) carries this score from GitHub, the CVE Numbering Authority, and added none of its own",
   "reason": "Found in the editor's source check of 21 October 2026: the case did not say who assigned the score. The NVD record for CVE-2026-107295 lists the 7.6 score (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) with source security-advisories@github.com as a 'Secondary' score and no NVD score; the maintainer's advisory GHSA-h4xc-3qfq-jf93 gives severity High, 7.6."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.regime_consequence",
   "old": "CVE-2026-107295; fixed in 1.107.4 and 2.28.0",
   "new": "CVE-2026-107295 (Common Vulnerabilities and Exposures identifier), published 8 October 2026; fixed in 1.107.4 and 2.28.0, released 12 August 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the dates that separate the fix from the CVE were missing. The NVD record was published 2026-10-08; the maintainer's release pages for v1.107.4 and v2.28.0 show them released on 12 August 2026 (Python Package Index uploads 2026-08-12)."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event",
   "old": "Maintainer advisory GHSA-h4xc-3qfq-jf93; NVD record published 8 October 2026; weakness classified as cross-site request forgery (CWE-352)",
   "new": "Maintainer advisory GHSA-h4xc-3qfq-jf93, published on the project's repository on 12 August 2026 and in the GitHub Advisory Database on 8 October 2026; NVD record CVE-2026-107295 published 8 October 2026. The advisory classifies the weakness as origin validation error (Common Weakness Enumeration CWE-346) and cross-site request forgery (CWE-352); the NVD record lists only CWE-352.",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's advisory GHSA-h4xc-3qfq-jf93 lists two weaknesses, CWE-346 Origin Validation Error and CWE-352 Cross-Site Request Forgery, and shows 'published ... Aug 12, 2026'; the GitHub Advisory Database entry is dated 2026-10-08 and the NVD record (published 2026-10-08) lists only CWE-352."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "Fixed in versions 1.107.4 and 2.28.0 via pull requests 7382 and 7383",
   "new": "Fixed in versions 1.107.4 and 2.28.0, released on 12 August 2026, via pull requests 7382 and 7383 (merged 11 August 2026), which make the chat endpoint refuse requests not sent as JavaScript Object Notation (JSON). A companion advisory on the same chat endpoint, GHSA-q2xc-rrxj-58x9, found that versions with this fix could still be reached from a web page by Domain Name System (DNS) rebinding because the server did not check the Host header; that was fixed in 1.107.5 and 2.30.0, released on 14 August 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: the release date was missing and the pull requests are not on the advisory page as read. The release pages show v2.28.0 and v1.107.4 released on 12 August 2026, listing #7382 and the v1 backport #7383; fix commit d2690201 is dated 11 August 2026. The maintainer's companion advisory GHSA-q2xc-rrxj-58x9 ('the local chat endpoint does not validate the Host header', published 14 August 2026) lists versions below 1.107.5 and 2.30.0 as affected, so 1.107.4 and 2.28.0 remained reachable by DNS rebinding; 1.107.5 and 2.30.0 were uploaded to the Python Package Index (PyPI) on 14 August 2026."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical.source_ids",
   "old": "[\"GHSA\"]",
   "new": "[\"GHSA\", \"NVD-107295\", \"FIX-7382\", \"REL-2-28-0\", \"REL-1-107-4\", \"GHSA-Q2XC\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the pull requests and release dates come from the NVD record, the maintainer's release pages and fix commit d2690201, and the DNS rebinding fix from the maintainer's advisory GHSA-q2xc-rrxj-58x9; those sources are added."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability",
   "old": "Coordinated disclosure through the maintainer's security advisory",
   "new": "Coordinated disclosure through the maintainer's security advisory, which credits Thai Son Dinh of VinSOC Labs (research and development) as the reporter",
   "reason": "Found in the editor's source check of 21 October 2026: the reporter was not named. The advisory GHSA-h4xc-3qfq-jf93 credits 'Thai Son Dinh from VinSOC Labs (R&D)' and lists the reporter account sondt99."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "An approval gate enforced by the client is an instruction to the client, not a mechanism: any caller that can reach the server can skip it. The approval decision has to be checked where the tool runs.",
   "new": "The maintainer's own documentation says the chat server trusts whatever approval decision the client sends, so any client that can reach the endpoint can approve a pending tool call, and calls approval prompts a convenience for the developer rather than an authorization control. The August 2026 fixes kept that design and instead stopped web pages from reaching the endpoint: it now accepts only requests sent as JavaScript Object Notation (JSON), which a browser will not send to another site without a permission check the server refuses, and, after a second fix two days later, only requests addressed to a local or explicitly allowed host name. The record does not show exploitation, a public proof of concept, or harm to any developer.",
   "reason": "Found in the editor's source check of 21 October 2026: the sentence 'The approval decision has to be checked where the tool runs' is a prescription no source makes, and the interpretation did not say what the record does not show. The maintainer's documentation in fix commit d2690201 says 'any client that can reach the endpoint can approve any pending call' and to 'Treat approval prompts as a convenience ... rather than an authorization control'; the fix requires 'Content-Type: application/json', which a browser 'cannot send cross-origin without a preflight that the server refuses'; advisory GHSA-q2xc-rrxj-58x9 adds the Host header check. No source reports exploitation (NVD record: the Cybersecurity and Infrastructure Security Agency's Stakeholder-Specific Vulnerability Categorization gives exploitation 'none'). The interpretation was not signed (signed_by null)."
  },
  {
   "date": "2026-10-21",
   "field": "inference.source_ids",
   "old": "[\"GHSA\"]",
   "new": "[\"GHSA\", \"FIX-7382\", \"GHSA-Q2XC\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the interpretation now rests on the maintainer's fix commit d2690201 and companion advisory GHSA-q2xc-rrxj-58x9 as well as GHSA-h4xc-3qfq-jf93."
  },
  {
   "date": "2026-10-21",
   "field": "sources.GHSA.title",
   "old": "Pydantic AI security advisory GHSA-h4xc-3qfq-jf93, with fix pull requests 7382 and 7383 and releases v1.107.4 and v2.28.0",
   "new": "Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93)",
   "reason": "Found in the editor's source check of 21 October 2026: the title was not the advisory's headline and named pull requests and releases that the advisory page, as read, does not list; the exact headline is used."
  },
  {
   "date": "2026-10-21",
   "field": "sources.GHSA.date",
   "old": "2026-10-08",
   "new": "2026-08-12",
   "reason": "Found in the editor's source check of 21 October 2026: the repository advisory page reads 'dsfaccini published GHSA-h4xc-3qfq-jf93 Aug 12, 2026'; 2026-10-08 is the date of the GitHub Advisory Database entry and the NVD record, not of this page."
  },
  {
   "date": "2026-10-21",
   "field": "sources.FIX-7382",
   "old": null,
   "new": "{\"title\": \"Only accept JSON request bodies on the web UI chat endpoint (#7382) (Pydantic AI commit d2690201)\", \"type\": \"company\", \"url\": \"https://github.com/pydantic/pydantic-ai/commit/d2690201a1834005d382dbf5c47e0ed94ef8bf46\", \"date\": \"2026-08-11\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own fix\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's fix commit (merged 11 August 2026) carries the documentation the interpretation relies on and the date of the fix."
  },
  {
   "date": "2026-10-21",
   "field": "sources.REL-2-28-0",
   "old": null,
   "new": "{\"title\": \"v2.28.0 (2026-08-11) (Pydantic AI release)\", \"type\": \"company\", \"url\": \"https://github.com/pydantic/pydantic-ai/releases/tag/v2.28.0\", \"date\": \"2026-08-12\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own release\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's release page shows v2.28.0 released on 12 August 2026 with the web chat fix (#7382) and a link to the advisory."
  },
  {
   "date": "2026-10-21",
   "field": "sources.REL-1-107-4",
   "old": null,
   "new": "{\"title\": \"v1.107.4 (2026-08-11) (Pydantic AI release)\", \"type\": \"company\", \"url\": \"https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.4\", \"date\": \"2026-08-12\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own release\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's release page shows v1.107.4 released on 12 August 2026 with the v1 backport (#7383)."
  },
  {
   "date": "2026-10-21",
   "field": "sources.GHSA-Q2XC",
   "old": null,
   "new": "{\"title\": \"Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (Pydantic AI security advisory GHSA-q2xc-rrxj-58x9)\", \"type\": \"company\", \"url\": \"https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9\", \"date\": \"2026-08-14\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own product\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's companion advisory (published 14 August 2026) shows versions 1.107.4 and 2.28.0 were still reachable by DNS rebinding until 1.107.5 and 2.30.0."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The maintainer's own documentation says the chat server trusts whatever approval decision the client sends, so any client that can reach the endpoint can approve a pending tool call, and calls approval prompts a convenience for the developer rather than an authorization control. The August 2026 fixes kept that design and instead stopped web pages from reaching the endpoint: it now accepts only requests sent as JavaScript Object Notation (JSON), which a browser will not send to another site without a permission check the server refuses, and, after a second fix two days later, only requests addressed to a local or explicitly allowed host name. The record does not show exploitation, a public proof of concept, or harm to any developer.",
   "new": "The maintainer's own documentation says the chat server trusts whatever approval decision the client sends, so any client that can reach the endpoint can approve a pending tool call, and calls approval prompts a convenience for the developer rather than an authorization control. The August 2026 fixes kept that design and instead stopped web pages from reaching the endpoint: it now accepts only requests sent as JavaScript Object Notation (JSON), which a browser will not send to another site without a permission check the server refuses, and, after a second fix two days later, only requests addressed to localhost, an Internet Protocol (IP) address, or an explicitly allowed host name. The record does not show exploitation, a public proof of concept, or harm to any developer.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the second fix also accepts any IP address, which is not a host name: the maintainer's documentation at commit 871c7aee says the server answers only requests whose Host header is an IP address or localhost, unless a host is explicitly allowed (GHSA-q2xc-rrxj-58x9)."
  },
  {
   "date": "2026-10-21",
   "field": "sources.FIX-7437",
   "old": null,
   "new": "{\"title\": \"Add `allowed_hosts` to `Agent.to_web()` and `clai web` (#7437) (Pydantic AI commit 871c7aee)\", \"type\": \"company\", \"url\": \"https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7\", \"date\": \"2026-08-13\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own fix\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: third check: the interpretation's 'an Internet Protocol (IP) address' rests on this commit's documentation ('answers only to requests whose Host header is an IP address ... or localhost'), which the case did not list."
  },
  {
   "date": "2026-10-22",
   "field": "outcome.regime_consequence",
   "old": "CVE-2026-107295 (Common Vulnerabilities and Exposures identifier), published 8 October 2026; fixed in 1.107.4 and 2.28.0, released 12 August 2026",
   "new": "none",
   "reason": "Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a CVE, an advisory, a score or a fix is not one. The CVE and fix details are already in the Evidence and Recovery fields, so nothing is lost. Found while drafting this case's letters, 22 October 2026."
  }
 ],
 "created": "2026-10-12",
 "last_reviewed": "2026-10-15",
 "reviewed_by": "Saurabh Bhatnagar (editor)",
 "derived_by": "agent"
}