---
id: CVE-2026-107288
title: >-
  Pydantic AI is a Python agent framework for building applications and
  workflows with Generative AI
summary: >-
  Pydantic AI is a Python agent framework for building applications and
  workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local
  web_fetch_tool and the WebFetch local fallback compare blocked_domains entries
  with a URL…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
  - CWE-1289
vendor: pydantic
product: pydantic-ai
affected:
  - 'pydantic-ai >= 1.77.0, < 1.107.6'
  - 'pydantic-ai >= 2.0.0b1, < 2.44.0'
  - 'pydantic-ai-slim >= 1.77.0, < 1.107.6'
  - 'pydantic-ai-slim >= 2.0.0b1, < 2.44.0'
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:35:31.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107288'
references:
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/490335f8e2322e143a79337ddca9410e0176c812
    label: security-advisories@github.com
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/a9dab92099d0ef9d5d4aa34ccac8a6f1b0e51284
    label: security-advisories@github.com
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/c1f212a084cbfa0012f2044cdb4731d214b3b983
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/pull/8407'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/pull/8409'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/pull/8421'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6'
    label: security-advisories@github.com
  - url: 'https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-22h6-qm39-v87j
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T17:28:31.014859Z'
ingestedAt: '2026-10-08T16:52:14.772Z'
---

## Overview

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.