Pydantic AI, a Python agent framework used for Generative AI workflows, contains an SSRF flaw in its URL download handling between versions 0.0.26 and before 1.56.0. Attackers who can feed message history from untrusted users can embed malicious URLs, causing the server to issue HTTP requests to internal IPs. This enables the attacker to read sensitive internal services, export cloud credential endpoints, or otherwise access data that should remain private. The weakness directly maps to CWE‑918, representing an input‑validation flaw that permits unintended outgoing network traffic.

The affected product is Pydantic AI from the Pydantic organization. Versions from 0.0.26 up to, but not including, 1.56.0 are vulnerable. Any deployment that accepts message history from external clients without restricting the URL domain is at risk.

The CVSS score of 8.6 ranks this vulnerability as high severity, yet the EPSS probability is less than 1 %, indicating current exploitation attempts are rare. It is not listed in the CISA KEV catalogue. An attacker must first supply crafted content that the application deems as legitimate message history, which is usually done over an HTTP or WebSocket interface. Once a valid request is accepted, the server executes a GET or equivalent request to the supplied URL, potentially reaching internal resources that are normally inaccessible to external traffic. Because the vector is server‑side, the attacker does not need elevated privileges on the target machine, only the ability to influence the message history content.