---
id: CVE-2026-114386
title: Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
summary: >-
  Pydantic AI Harness before 0.59.0 fails to enforce
  UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in
  the CodeMode toolset. Users or prompt-injected content can make the sandboxed
  program invoke tools via run_n…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-770
vendor: pydantic
product: pydantic-ai-harness
affected:
  - pydantic-ai-harness < 0.59.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:43.886Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114386'
references:
  - url: 'https://github.com/pydantic/pydantic-ai/pull/10362'
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/eb27b2b89fe76ae23ee9b6fc9eb4b227a4967949
  - url: 'https://github.com/pydantic/pydantic-ai/releases/tag/v2.59.0'
    label: pydantic-ai-harness v2.59.0 Release Notes
  - url: >-
      https://github.com/pydantic/pydantic-ai/blob/v2.58.0/src/pydantic_ai_harness/pydantic_ai_harness/code_mode/_toolset.py#L642-L680
  - url: 'https://pypi.org/project/pydantic-ai-harness/0.59.0/'
  - url: >-
      https://www.vulncheck.com/advisories/pydantic-ai-harness-before-0.59.0-codemode-tool-call-limit-bypass-via-run-code
    label: >-
      VulnCheck Advisory: Pydantic AI Harness before 0.59.0 CodeMode Tool Call
      Limit Bypass via run_code
tags:
  - cve.org
ingestedAt: '2026-10-21T12:48:53.658Z'
---

## Overview

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

## Affected

- `pydantic-ai-harness < 0.59.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.