AIKIDO-2026-48572
pydantic-ai-slim is vulnerable to Origin Validation Error
64
Medium Risk
This Affects:
pydantic-ai-slimTL;DR
The local development web chat UI served by Agent.to_web() and clai web does not validate the Host header on incoming requests. A website the developer visits can use DNS rebinding to point a name it controls at the loopback address, so the browser treats requests to the locally bound chat endpoint as same-origin and bypasses origin and CSRF protections. This lets the remote page drive the served agent and run its tools with the privileges and credentials of the local process, exposing data and triggering unwanted tool side effects. The fix adds Host-header validation middleware that rejects any host other than localhost, a loopback or LAN address, or an explicitly allowed host, returning a 421 response.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, serve an agent through the local web chat UI (Agent.to_web() or clai web), and open a page under untrusted or external control while that UI is running. Binding to localhost alone does not remove this exposure.
Background info
pydantic-ai-slim is vulnerable to Origin Validation Error in versions 1.34.0 - 1.107.4 and 2.0.0 - 2.29.0.
How to fix this
Upgrade the pydantic-ai-slim and/or the pydantic-ai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant