Why it mattersTeams that let untrusted text reach a Pydantic AI agent need to upgrade. Several of the holes can be triggered from the content a tool fetches or a user sends.
Pydantic AI 2.66.0 patches ten security advisories at once. Two are rated high, six are rated medium, and one is rated low. The release landed on 4 November and is written up on the project's GitHub release page.
Pydantic AI is a Python framework for building language-model agents. It wires a model up to tools. It also checks the arguments the model sends. And it stores the conversation. The ten fixes touch almost every one of those surfaces.
The two high-rated holes
The first high is in the web_fetch_tool and in the local fallback of the WebFetch capability. Pydantic says both re-indented a JSON response on the event loop before applying the returned-content limit. A deeply nested JSON file inside the size cap could expand to hundreds of times its size in memory. The process would use a lot of memory and delay other work. Any agent that lets an attacker choose or influence the URLs it fetches is affected.
The second high is in Pydantic AI Harness's secret redaction. The private_key pattern, included by default, backtracked exponentially on crafted text. Pydantic says a few hundred characters that begin like a private key can tie up the event loop for minutes. Any team that calls redact_secrets or secret_data() on text an attacker can influence is affected.
A credential leak on Tencent Cloud
A medium advisory, GHSA-5fj9-5pjw-vpwc, says the cloud-metadata blocklist for URL downloads did not include Tencent Cloud's instance metadata address, 169.254.0.23. Someone who can supply a URL the application downloads could have it read the instance's temporary role credentials. The project says this affects teams that run on Tencent Cloud and allow local URLs through force_download='allow-local' or web_fetch_tool(allow_local_urls=True).
Another medium advisory covers OpenTelemetry traces. With embedding instrumentation on, spans recorded the extra_headers and extra_body settings. Pydantic says credentials passed through those settings could be read by anyone with access to the exported traces. The project says to rotate those credentials and restrict access to historical traces.
Schema blow-ups and a type-confusion bug
Three advisories cover exponential schema expansion on the event loop. One is in tool schemas that lack $defs and $ref support. One is in decision models such as OpenAIDecisionsModel. One is in message loads through the Vercel AI and AG-UI adapters. All three can be triggered by schemas or messages a client supplies.
The last medium, GHSA-4cj4-hgwf-4hc4, is a type-confusion bug. A message history can be saved to disk and loaded again. When that happens, a tool result that looks like one of Pydantic AI's file types is rebuilt as that file. A third party who controls what a tool returns can abuse this. They can make the application fetch a URL on its local network. Or make the model provider read an S3 object with the application's credentials.
The security batch is in v2.66.0 on pydantic-ai and pydantic-ai-slim, and in v1.107.10 for teams still on the 1.x line. The harness fixes are in pydantic-ai-harness 0.66.0. The release page lists each advisory with a link to its full write-up.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
