CNNVD-202602-949 Information
CNNVD ID
CNNVD-202602-949
Related CVE
- CNNVD Published: 2026-02-06
Description (Chinese)
pydantic-ai是Pydantic开源的一个用于构建生产级应用程序和工作流的生成式AI框架。 pydantic-ai 1.34.0至1.51.0之前版本存在跨站脚本漏洞，该漏洞源于Web UI存在路径遍历，可能允许攻击者通过特制URL在应用环境中提供任意JavaScript，导致客户端数据泄露。
Description (English)
Pydantic-ai is a production-based AI framework for the construction of production-level applications and workflows. Prior to the pydantic-ai 1,34.0 to 1.51.0, there was a cross-site script loophole, which originated in Web UI ’ s routing, which may allow the assailant to provide any kind of JavaScript in the application environment through a customized URL, leading to the disclosure of client data.
Hazard Level
High
Vulnerability Type
跨站脚本
Affected Vendor
Pydantic
Published
2026-02-06
Last Modified
2026-02-24
References
https://github.com/pydantic/pydantic-ai/releases/tag/v1.51.0 https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-wjp5-868j-wqv7 https://access.redhat.com/security/cve/cve-2026-25640