AIKIDO-2026-187702
pydantic-ai-slim is vulnerable to Server-Side Request Forgery (SSRF)
68
Medium Risk
This Affects:
pydantic-ai-slimTL;DR
When an application opts a URL into local network access, the cloud-metadata IP blocklist compares addresses by set membership, and Python includes an IPv6 zone identifier in that address's equality and hashing. A metadata address written with a zone identifier does not match the blocklist even though the network stack ignores the zone identifier and delivers the request to the metadata endpoint anyway, exposing cloud IAM credentials on IPv6-enabled hosts. The fix drops the zone identifier before comparing an address against the metadata and private-range blocklists.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you opt a URL into local network access with FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True) in an IPv6-enabled environment.
Background info
pydantic-ai-slim is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.56.0 - 1.107.5 and 2.0.0 - 2.43.0.
How to fix this
Upgrade the pydantic-ai-slim and/or the pydantic-ai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.