https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:18:48 +0000 https://cve.radiocsirt.org/vuln/brew-oterm-cve-2026-54249 <p><strong>Affected:</strong> Homebrew: oterm</p> <p>### Summary</p> <p>A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application&#39;s model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server&#39;s own credentials, allowing the client to read files it should not have access to.</p> <p>### Details</p> <p>UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.</p> <p>Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client&#39;s, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.</p> <p>### Impact</p> <p>Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.</p> <p>### Patches</p> <p>Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` referenc…</p> <p><strong>Affected:</strong> Homebrew: oterm</p> <p>### Summary</p> <p>A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application&#39;s model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server&#39;s own credentials, allowing the client to read files it should not have access to.</p> <p>### Details</p> <p>UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.</p> <p>Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client&#39;s, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.</p> <p>### Impact</p> <p>Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.</p> <p>### Patches</p> <p>Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` referenc…</p> https://cve.radiocsirt.org/vuln/brew-oterm-cve-2026-54249 https://cve.radiocsirt.org/vuln/cve-2026-54249 <p><strong>Affected:</strong> pydantic-ai, pydantic-ai-slim</p> <p>Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application&#39;s model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client&#39;s, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.</p> <p><strong>Affected:</strong> pydantic-ai, pydantic-ai-slim</p> <p>Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application&#39;s model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…, gs://…) — were forwarded without validation. Because the provider resolves an UploadedFile using the server-side identity (IAM role, service account, or provider API key) rather than the client&#39;s, an attacker can craft message history to make the server read objects from its own account or other tenants, given a referenceable identifier. Exploitation requires a valid file identifier, which is not always unguessable depending on how the application names objects. This issue has been fixed in versions 1.106.0 and 2.0.0b6.</p> https://cve.radiocsirt.org/vuln/cve-2026-54249 https://cve.radiocsirt.org/vuln/ghsa-h7p7-w5gc-xj3w <p><strong>Affected:</strong> PyPI: pydantic-ai-slim, PyPI: pydantic-ai</p> <p>### Summary</p> <p>A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application&#39;s model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server&#39;s own credentials, allowing the client to read files it should not have access to.</p> <p>### Details</p> <p>UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.</p> <p>Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client&#39;s, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.</p> <p>### Impact</p> <p>Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.</p> <p>### Patches</p> <p>Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` referenc…</p> <p><strong>Affected:</strong> PyPI: pydantic-ai-slim, PyPI: pydantic-ai</p> <p>### Summary</p> <p>A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application&#39;s model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server&#39;s own credentials, allowing the client to read files it should not have access to.</p> <p>### Details</p> <p>UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.</p> <p>Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client&#39;s, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.</p> <p>### Impact</p> <p>Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.</p> <p>### Patches</p> <p>Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` referenc…</p> https://cve.radiocsirt.org/vuln/ghsa-h7p7-w5gc-xj3w