CVE-2026-65975

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.88.0 through 1.107.0 Pydantic AI versions 2.0.0b1 through 2.4.9

Description UI adapters (AG-UI via Agent.to ag ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) use sanitize messages to remove unresolved client-submitted tool calls from untrusted message history. A flaw in how the strip operation is anchored to a message index allows a remote client to bypass this defense. When a trailing client message is sanitized to empty and dropped, a preceding assistant response containing an unresolved tool call can be dispatched without inspection. This allows a remote client to execute registered, non-approval server tools using client-supplied arguments instead of model-generated ones. This is particularly critical for applications using model-request hooks (before model request / after model request) to gate tool execution, as forged calls bypass the model turn and these guardrails. Tools requiring approval (requires approval=True) are not affected.

Recommendations Update to version 1.107.1. Update to version 2.5.0.