Pydantic AI: a web page can make a developer's local agent run and execute tools, including tools marked as requiring approval, fixed August 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A developer running a Pydantic AI agent locally through Agent.to_web() or the clai web development chat | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
| Mandate: objective | Serve a local chat interface for developing and testing an agent | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
| Actor | The agent served by the local chat endpoint, holding the privileges and credentials of the local process | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
| Inputs | A request submitted by a website the developer visits, to the loopback-hosted chat server; the endpoint did not validate the request content type | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93); NVD record CVE-2026-107295 (CNA: GitHub), CVSS 3.1 7.6, CWE-352 | high |
| Decision | not evidenced in source | assertion | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | low |
| Envelope: authority | The agent's tools ran with the privileges and credentials of the local process; binding to localhost did not prevent a browser page from reaching it | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
| Envelope: constraints | Tools marked requires_approval remained exposed because approval decisions were relayed by the client | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
| Action | The served agent runs and executes tools on the attacker's request | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
| Outcome | State: averted by disclosure. No exploitation reported. As of Oct 2026. | assertion | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93); NVD record CVE-2026-107295 (CNA: GitHub), CVSS 3.1 7.6, CWE-352 | medium |
| Evidence: event | Maintainer advisory GHSA-h4xc-3qfq-jf93, published on the project's repository on 12 August 2026 and in the GitHub Advisory Database on 8 October 2026; NVD record CVE-2026-107295 published 8 October 2026. The advisory classifies the weakness as origin validation error (Common Weakness Enumeration CWE-346) and cross-site request forgery (CWE-352); the NVD record lists only CWE-352. | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93); NVD record CVE-2026-107295 (CNA: GitHub), CVSS 3.1 7.6, CWE-352 | high |
| Recovery: technical | Fixed in versions 1.107.4 and 2.28.0, released on 12 August 2026, via pull requests 7382 and 7383 (merged 11 August 2026), which make the chat endpoint refuse requests not sent as JavaScript Object Notation (JSON). A companion advisory on the same chat endpoint, GHSA-q2xc-rrxj-58x9, found that versions with this fix could still be reached from a web page by Domain Name System (DNS) rebinding because the server did not check the Host header; that was fixed in 1.107.5 and 2.30.0, released on 14 August 2026. | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93); NVD record CVE-2026-107295 (CNA: GitHub), CVSS 3.1 7.6, CWE-352; Only accept JSON request bodies on the web UI chat endpoint (#7382) (Pydantic AI commit d2690201); v2.28.0 (2026-08-11) (Pydantic AI release); v1.107.4 (2026-08-11) (Pydantic AI release); Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (Pydantic AI security advisory GHSA-q2xc-rrxj-58x9) | high |
| Recovery: accountability | Coordinated disclosure through the maintainer's security advisory, which credits Thai Son Dinh of VinSOC Labs (research and development) as the reporter | fact | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Client-relayed approval left requires_approval tools exposed | C-E3 Destructive-action gate |
| failed | Request origin not verified (no content-type validation) | C-A1 Actor identity verification |
| succeeded | Coordinated disclosure and fix | C-O1 Coordinated disclosure program |
| absent | Tools ran with the full privileges and credentials of the local process | C-E1 Least-privilege credential scoped to task |
Inference
inference The maintainer's own documentation says the chat server trusts whatever approval decision the client sends, so any client that can reach the endpoint can approve a pending tool call, and calls approval prompts a convenience for the developer rather than an authorization control. The August 2026 fixes kept that design and instead stopped web pages from reaching the endpoint: it now accepts only requests sent as JavaScript Object Notation (JSON), which a browser will not send to another site without a permission check the server refuses, and, after a second fix two days later, only requests addressed to localhost, an Internet Protocol (IP) address, or an explicitly allowed host name. The record does not show exploitation, a public proof of concept, or harm to any developer.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| GHSA | Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (Pydantic AI security advisory GHSA-h4xc-3qfq-jf93) | company | github.com ↗ |
| NVD-107295 | NVD record CVE-2026-107295 (CNA: GitHub), CVSS 3.1 7.6, CWE-352 | standards body | nvd.nist.gov ↗ |
| FIX-7382 | Only accept JSON request bodies on the web UI chat endpoint (#7382) (Pydantic AI commit d2690201) (interest: vendor describing its own fix) | company primary record | github.com ↗ checked 2026-10-21 |
| REL-2-28-0 | v2.28.0 (2026-08-11) (Pydantic AI release) (interest: vendor describing its own release) | company primary record | github.com ↗ checked 2026-10-21 |
| REL-1-107-4 | v1.107.4 (2026-08-11) (Pydantic AI release) (interest: vendor describing its own release) | company primary record | github.com ↗ checked 2026-10-21 |
| GHSA-Q2XC | Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (Pydantic AI security advisory GHSA-q2xc-rrxj-58x9) (interest: vendor describing its own product) | company primary record | github.com ↗ checked 2026-10-21 |
| FIX-7437 | Add `allowed_hosts` to `Agent.to_web()` and `clai web` (#7437) (Pydantic AI commit 871c7aee) (interest: vendor describing its own fix) | company primary record | github.com ↗ checked 2026-10-21 |