Tools
pydantic-ai patches four advisories, all reached through the agent's web_fetch tool
v2.44.0 (2026-09-17) fixes GHSA-vmxc-h2x2-jmf3 (IPv6 zone identifier bypasses the cloud-metadata and private-IP blocklists), GHSA-fpf4-vwcp-v4hp (superlinear HTML conversion and charset decode on the event loop, so one attacker-chosen page stalls every agent in the process), GHSA-22h6-qm39-v87j (domain lists compared as written rather than as the resolver normalizes them) and GHSA-4x9p-g9wm-8q7f (spans carried instructions and error content despite `include_content=False`). Patched in 2.44.0 and 1.107.6. The lesson generalizes: a fetch tool is an SSRF primitive plus an unbounded parser sitting on your event loop.
Source
↳ Follow the thread