WebFetch Local Fallback Vulnerability in Pydantic AI Framework by Pydantic
CVE-2026-107290
What is CVE-2026-107290?
The Pydantic AI framework experiences a vulnerability where the local web_fetch_tool and WebFetch local fallback process can be exploited to deliver server-controlled responses. This may lead to significant event loop blocking due to quadratic title extraction, particularly when attackers use moderately sized pages. In some cases, the use of unsupported codecs or excessively nested HTML or JSON structures may result in aborted agent runs. This vulnerability can significantly hinder application performance and workflow execution, making it imperative for users to upgrade to versions 1.107.6 or 2.44.0.
Affected Version(s)
pydantic-ai >= 1.77.0, < 1.107.6 < 1.77.0, 1.107.6
pydantic-ai >= 2.0.0b1, < 2.44.0 < 2.0.0b1, 2.44.0
pydantic-ai-slim >= 1.77.0, < 1.107.6 < 1.77.0, 1.107.6