CVE-2026-25580

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 0.0.26 through 1.55.9

Description A Server-Side Request Forgery (SSRF) issue exists in the URL download functionality, specifically within the download item() function. This occurs when applications accept message history from untrusted external sources, allowing attackers to provide malicious URLs. The server may then perform unauthorized HTTP requests to internal network resources, such as loopback addresses, private IP ranges, or cloud metadata endpoints (e.g., AWS IMDSv1), potentially leading to the disclosure of sensitive internal information or cloud credentials. This issue affects applications using Agent.to web, clai web, VercelAIAdapter, AGUIAdapter, Agent.to ag ui, or custom APIs that process ImageUrl, AudioUrl, VideoUrl, or DocumentUrl objects from user input.

Recommendations Upgrade to version 1.56.0 or later. As a temporary workaround, implement a history processor to filter out URLs targeting local or private IP addresses before they are processed by the agent.