Pydantic AI hat Stored XSS über Path Traversal in Web UI CDN URL

An attacker can exploit this XSS vulnerability by crafting a malicious URL and enticing a user to click it or visit it within an iframe. Upon interaction, the attacker-controlled JavaScript code executes within the victim's browser, operating under the context of the Pydantic AI application. This allows the attacker to steal sensitive data stored on the client-side, such as chat history and potentially other session-related information. The impact is particularly concerning if the application is used to handle sensitive data or if users are not aware of the potential risks associated with clicking untrusted links. The vulnerability is limited to applications utilizing Agent.to_web or clai web to serve a chat interface.

Developers and users of Pydantic AI who are utilizing Agent.to_web or clai web to serve chat interfaces, particularly those running these interfaces in environments accessible from outside the local machine (e.g., shared hosting, cloud deployments). Legacy configurations or deployments that haven't been updated to the latest version are also at increased risk.

• python / web:

import requests
import re

url = "http://localhost:8000/chat?message=<script>alert('XSS')</script>"
response = requests.get(url)

if re.search(r'<script>', response.text, re.IGNORECASE):
    print("Potential XSS vulnerability detected!")
else:
    print("No XSS detected.")

1. 2026-02-06Disclosure

   disclosure

1. Reserviert2026-02-04
2. Veröffentlicht2026-02-06
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25640 is to upgrade to Pydantic AI version 1.51.0 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as carefully validating all user-supplied input before rendering it in the web UI. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection. Monitor access logs for unusual activity or attempts to access suspicious URLs.