CyberRota Analysis
AI-GeneratedVersions 1.65.0 through 1.105.0 and 2.0.0b1 through 2.0.0b5 of the Pydantic AI framework are vulnerable to unauthorized file access, allowing clients to reference arbitrary files in the application's model-provider or cloud-storage accounts. This can lead to exposure of sensitive data, as attackers can exploit the lack of validation on UploadedFile references to access files using server-side credentials. Organizations using affected versions should prioritize updating to versions 1.106.0 or 2.0.0b6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client's, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.
Related CVEs
Other vulnerabilities affecting the same vendor(s)