A Path Traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data.
This vulnerability only affects applications that use:
Agent.to_web to serve a chat interfaceclai web to serve a chat interface from the CLIThese are typically run locally (on localhost), but may also be deployed on a remote server.
The web UI serves its frontend HTML by fetching it from a CDN. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package.
Projects are affected if your application uses Agent.to_web or clai web to serve the Pydantic AI chat interface.
An attacker crafts a URL pointing to the victim's Pydantic AI web UI instance (either localhost with the known port, or a remote server endpoint) with a malicious version query parameter containing path traversal sequences.
The attacker gets the victim to visit this URL — directly via a link, through a redirect, or by embedding it in an iframe.
When the victim's browser loads the page, the server fetches and serves attacker-controlled HTML/JavaScript instead of the legitimate chat UI.
The attacker's JavaScript executes in the victim's browser in the context of the Pydantic AI web application, with access to:
localStorage (all user messages and AI responses)HttpOnly, if...1.34.01.35.01.36.01.37.01.38.01.39.01.39.11.40.01.41.01.42.0+7 more1.51.0Exploitability
AV:NAC:LPR:NUI:RScope
S:UImpact
C:HI:LA:NCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N