Pydantic AI UI adapters, including the Vercel AI adapter, incorrectly trust client‑supplied providerMetadata when constructing UploadedFile objects. An attacker can embed a reference to a provider file identifier or a cloud‑storage URI in the message history. Because the server resolves the UploadedFile using its own IAM credentials rather than the requester’s, the attacker can cause the server to read any file that can be referenced, including objects owned by other tenants. The result is a confidential disclosure of arbitrary files. This is an uncontrolled resource access flaw (CWE‑918).

The vulnerability exists in Pydantic AI versions 1.65.0 through 1.105.0 and in the beta releases 2.0.0b1 through 2.0.0b5 for both the standard pydantic‑ai and the slim variant. These products are commonly used in generative AI UIs, including the Vercel AI adapter.

The CVSS score of 6.8 indicates moderate severity, but the EPSS score of less than 1 % signals a very low current exploitation probability. It is not listed in CISA’s KEV catalog, so no widespread known attacks have been reported. Exploitation can be carried out remotely by an attacker who submits a crafted message containing a valid provider file identifier; discovery of such identifiers may depend on how the application names objects. Server‑side identity is used to resolve the file, so the attacker does not need privileged credentials beyond the ability to reference existing objects.