Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL

Vulnerability

Overview

CVE-2026-25640 is a path traversal vulnerability in the Pydantic AI web UI, affecting versions 1.34.0 through just before 1.51.0. The root cause is that the web UI constructs a CDN URL using a version query parameter directly from the request URL without proper validation. An attacker can inject path traversal sequences (e.g., ../) into this parameter, causing the server to fetch and serve arbitrary HTML or JavaScript from a different location on the same CDN instead of the legitimate chat UI package [1][2][4].

Exploitation

To exploit this vulnerability, the attacker crafts a malicious URL targeting a victim's Pydantic AI web UI instance, which may be running locally (on localhost) or on a remote server. The attack is only possible if the application uses Agent.to_web to serve a chat interface or clai web directly from the CLI. The victim must then visit the attacker-supplied URL—either by clicking a link, following a redirect, or through an embedded iframe. The server processes the malformed version parameter, fetches attacker-controlled content from the CDN, and serves it to the victim's browser in the context of the legitimate Pydantic AI web application [2][4].

Impact

Once the attacker's JavaScript executes in the victim's browser, it gains full access to the web application's origin, including any chat history stored in localStorage (all user messages and AI responses) and any session cookies not set as HttpOnly. This client-side data theft can compromise sensitive conversations and potentially lead to session hijacking if authentication middleware is configured [2][4].

Mitigation

The vulnerability is fixed in version 1.51.0 of Pydantic AI [2][3]. Users should upgrade to this version or later immediately. There are no known workarounds; the fix removes the user-controllable version parameter from the CDN URL construction [4].