AIKIDO-2026-555424
pydantic-ai-slim is vulnerable to Cross-Site Request Forgery (CSRF)
76
High Risk
This Affects:
pydantic-ai-slimTL;DR
The development web chat UI served by Agent.to_web() and clai web does not validate the request content type on its chat endpoint. A cross-origin page open in a developer's browser can send a simple request to the loopback chat endpoint, causing the served agent to run and execute its tools with the local process's privileges and credentials. Tools marked as requiring approval are not protected either because the endpoint trusts approval decisions relayed by the client. The fix requires a Content-Type: application/json header and rejects other requests before the body is parsed or the agent runs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serve an agent through the development web chat UI (Agent.to_web() or clai web).
Background info
pydantic-ai-slim is vulnerable to Cross-Site Request Forgery (CSRF) in versions 1.34.0 - 1.107.2 and 2.0.0 - 2.27.1.
How to fix this
Upgrade the pydantic-ai-slim and/or the pydantic-ai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant