PyPI: pydantic-ai
CVE-2026-25580
Safety vulnerability ID: SFTY-20260206-11963
Safety legacy ID: pyup.io-86124
Affected versions of the pydantic-ai package are vulnerable to Server-Side Request Forgery (SSRF) due to missing validation that downloaded URLs resolve to public internet addresses. The download_item() helper is invoked by URL-backed message parts (for example, ImageUrl, AudioUrl, VideoUrl, and DocumentUrl) and can be reached through integrations such as Agent.to_web, VercelAIAdapter, and Agent.to_ag_ui, allowing user-supplied message history to trigger server-side HTTP requests without blocking localhost, private IP ranges, or cloud metadata endpoints.
Overview
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Advisory
Affected versions of the pydantic-ai package are vulnerable to Server-Side Request Forgery (SSRF) due to missing validation that downloaded URLs resolve to public internet addresses. The download_item() helper is invoked by URL-backed message parts (for example, ImageUrl, AudioUrl, VideoUrl, and DocumentUrl) and can be reached through integrations such as Agent.to_web, VercelAIAdapter, and Agent.to_ag_ui, allowing user-supplied message history to trigger server-side HTTP requests without blocking localhost, private IP ranges, or cloud metadata endpoints.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260206-11963/CVE-2026-25580
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25580
- https://github.com/advisories/GHSA-2jrp-274c-jhv3
- https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3
- https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301
- https://nvd.nist.gov/vuln/detail/CVE-2026-25580
- https://github.com/advisories/GHSA-2jrp-274c-jhv3
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more