Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before_model_request / after_model_request), since a forged call skips the model turn and bypasses that guardrail; approval-gated tools (requires_approval=True) are not auto-executed by this path. This issue has been fixed in versions 1.107.1 and 2.5.0.
Published: 2026-07-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the misuse of a message sanitizer that removes unresolved client-supplied tool calls but relies on a message index calculated before sanitization. When a client sends a trailing message that sanitizes to an empty string, the next message—an assistant response with an unresolved tool call—becomes the terminal message and is dispatched without inspection. This allows a remote client to trigger a registered non-approval server tool with arbitrary arguments supplied by the client, bypassing the model-request guardrails. The impact is confined to the capabilities of the affected tools; if the tool performs privileged actions, the flaw can lead to unauthorized tool execution or similar damage.

Affected Systems

The affected products are the Pydantic AI framework, specifically the pydantic-ai and pydantic-ai‑slim packages. Versions 1.88.0 through 1.107.0, and 2.0.0b1 through 2.4.9 are impacted. All other released versions are considered safe.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires a legitimate endpoint that accepts client messages via the AG‑UI or Vercel AI adapters, and the attacker must craft a message that sanitizes to nothing to make a prior assistant tool call the new tail. If the tool is flagged with requires_approval=True, the flaw does not auto‑execute it, mitigating the risk in that scenario.

Generated by OpenCVE AI on August 2, 2026 at 07:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Pydantic AI package to version 1.107.1 or later, or 2.5.0 or later, which contains the fix for the sanitization index bug.
  • Configure the system so that only tools marked as requires_approval=True can be auto‑executed, eliminating the risk posed by non‑approval tools executed via this path.
  • Add application‑level checks that validate tool calls before execution, ensuring that only calls originating from a model turn are permitted, even if the sanitizer has dropped earlier client messages.

Generated by OpenCVE AI on August 2, 2026 at 07:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Pydantic
Pydantic pydantic-ai
Vendors & Products Pydantic
Pydantic pydantic-ai

Wed, 29 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize_messages to strip unresolved ("dangling") client-submitted tool calls from untrusted message history before it reaches the agent, a defense-in-depth default that prevents the agent from executing tool calls the model never emitted. However, the strip anchored to a message index computed before sanitization ran, so when a trailing client message sanitized to empty and was dropped (for example a client system message under the default manage_system_prompt='server'), a preceding assistant response carrying an unresolved tool call became the new tail and was dispatched without inspection. As a result, a remote client could cause a registered, non-approval server tool to run with client-supplied arguments rather than arguments the model produced. The impact is bounded by what the affected tools do and is most significant for applications that gate tool execution in a model-request hook (before_model_request / after_model_request), since a forged call skips the model turn and bypasses that guardrail; approval-gated tools (requires_approval=True) are not auto-executed by this path. This issue has been fixed in versions 1.107.1 and 2.5.0.
Title Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Pydantic Pydantic-ai Pydantic Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-30T13:54:35.306Z

Reserved: 2026-07-23T18:15:14.581Z

Link: CVE-2026-65975

cve-icon Vulnrichment

Updated: 2026-07-30T13:54:29.156Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T21:17:47.723

Modified: 2026-08-04T12:43:40.373

Link: CVE-2026-65975

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T07:45:03Z

Weaknesses