Industry story
Pydantic AI Patches DNS Rebinding Vulnerability in Local Agent Web UI
agent-framework guardrails security tool-use
Pydantic AI's v1.107.5 patch is a quiet reminder that "local dev only" is not a security boundary. The GHSA-q2xc-rrxj-58x9 vulnerability in Agent.to_web() let a malicious website use DNS rebinding to reach your locally running agent and execute it with your credentials and tools. No special access required beyond getting you to visit a page. The fix validates the Host header against localhost and LAN addresses by default, which is the right call, but anyone serving the UI under a real hostname now has to explicitly set allowed_hosts or requests bounce.
Full analysis
Pydantic AI v1.107.5 fixes a security vulnerability (GHSA-q2xc-rrxj-58x9) in its local development web chat UI (Agent.to_web() / clai web). The flaw allowed DNS rebinding attacks to reach the agent and execute it using the developer's local tools and credentials without authorization. In a DNS rebinding attack, a malicious website tricks a browser into making requests to a locally running service. The fix validates the Host header against localhost/loopback/LAN addresses by default; any deployment served under a real hostname must explicitly opt in via the new allowed_hosts setting.
Comments