{"action":"Upgrade pydantic-ai-slim to 1.107.5 or later.","affected":[{"fixed":"1.107.5","introduced":"1.34.0"},{"fixed":"2.30.0","introduced":"2.0.0b1"}],"component":"pydantic-ai-slim","cve_ids":["CVE-2026-107292"],"ecosystem":"PyPI","epss":0.00132,"exploited":false,"fixed_versions":["1.107.5","2.30.0"],"ghsa_id":"GHSA-q2xc-rrxj-58x9","id":"tcs_01M5KFV42J74633DJD0DKM8WAM","modified_at":"2026-10-15T14:55:53.965535964Z","published_at":"2026-10-08T17:16:39Z","references":["https://osv.dev/vulnerability/GHSA-q2xc-rrxj-58x9","https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-q2xc-rrxj-58x9","https://github.com/pydantic/pydantic-ai/pull/7437","https://github.com/pydantic/pydantic-ai/pull/7438","https://github.com/pydantic/pydantic-ai/commit/394cc1d31656620704a703a2daed752afa5135fe","https://github.com/pydantic/pydantic-ai/commit/871c7aeec5dfed2138655ccbccbf15c6d763bae7","https://github.com/pydantic/pydantic-ai","https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.5","https://github.com/pydantic/pydantic-ai/releases/tag/v2.30.0"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-q2xc-rrxj-58x9#PyPI/pydantic-ai-slim","url":"https://osv.dev/vulnerability/GHSA-q2xc-rrxj-58x9"}],"summary":"Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header"}