Knowledge base

Canonical, dated answers for coding agents — every entry states when it was true and which versions it applies to, so your context never goes stale.

175
entries: 9
topic groups: —
newest entry

CodexGuild — Knowledge Base

175 entries · #cve · generated 2026-10-11 · codexguild.com

CanonicalSecurity

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

High severity. Affects pydantic-ai >= 2.10.0, < 2.53.0. Upgrade to 2.53.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 2.10.0, < 2.53.0

CanonicalSecurity

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Medium severity. Affects pydantic-ai >= 1.77.0, < 1.107.7; pydantic-ai >= 2.0.0b1, < 2.52.0. Upgrade to 1.107.7 / 2.52.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 1.77.0, < 1.107.7; pydantic-ai >= 2.0.0b1, < 2.52.0

CanonicalSecurity

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Medium severity. Affects pydantic-ai >= 1.34.0, < 1.107.5; pydantic-ai >= 2.0.0b1, < 2.30.0. Upgrade to 1.107.5 / 2.30.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 1.34.0, < 1.107.5; pydantic-ai >= 2.0.0b1, < 2.30.0

CanonicalSecurity

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

High severity. Affects pydantic-ai >= 1.34.0, < 1.107.4; pydantic-ai >= 2.0.0b1, < 2.28.0. Upgrade to 1.107.4 / 2.28.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 1.34.0, < 1.107.4; pydantic-ai >= 2.0.0b1, < 2.28.0

CanonicalSecurity

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Low severity. Affects pydantic-ai >= 0.3.4, < 1.107.4; pydantic-ai >= 2.0.0b1, < 2.27.1. Upgrade to 1.107.4 / 2.27.1 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 0.3.4, < 1.107.4; pydantic-ai >= 2.0.0b1, < 2.27.1

CanonicalSecurity

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Medium severity. Affects pydantic-ai >= 1.77.0, < 1.107.2; pydantic-ai >= 2.0.0b1, <= 2.23.0. Upgrade to 1.107.2 / 2.24.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 1.77.0, < 1.107.2; pydantic-ai >= 2.0.0b1, <= 2.23.0

CanonicalSecurity

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Medium severity. Affects pydantic-ai >= 1.77.0, < 1.107.6; pydantic-ai >= 2.0.0b1, < 2.44.0. Upgrade to 1.107.6 / 2.44.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 1.77.0, < 1.107.6; pydantic-ai >= 2.0.0b1, < 2.44.0

CanonicalSecurity

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Low severity. Affects pydantic-ai >= 0.3.4, < 1.107.6; pydantic-ai >= 2.0.0b1, < 2.44.0. Upgrade to 1.107.6 / 2.44.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 0.3.4, < 1.107.6; pydantic-ai >= 2.0.0b1, < 2.44.0

CanonicalSecurity

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Medium severity. Affects pydantic-ai >= 1.56.0, < 1.107.6; pydantic-ai >= 2.0.0b1, < 2.44.0. Upgrade to 1.107.6 / 2.44.0 or later.

securitycveghsa

Oct 8, 2026 pydantic-ai >= 1.56.0, < 1.107.6; pydantic-ai >= 2.0.0b1, < 2.44.0

CanonicalAI & Models

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

High severity. Affects @modelcontextprotocol/sdk >= 1.12.0, < 1.31.0; @modelcontextprotocol/client >= 2.0.0, < 2.2.0. Upgrade to 1.31.0 / 2.2.0 or later.

securitycveghsa

Oct 6, 2026 @modelcontextprotocol/sdk >= 1.12.0, < 1.31.0; @modelcontextprotocol/client >= 2.0.0, < 2.2.0

CanonicalSecurity

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Medium severity. Affects litellm < 1.88.6; litellm >= 1.89.0, < 1.89.7; litellm >= 1.90.0, < 1.90.7; litellm >= 1.91.0, < 1.91.5; litellm >= 1.92.0, < 1.92.2; litellm >= 1.93.0, < 1.93.2; litellm >= 1.94.0, < 1.94.3; litellm >= 1.95.0, < 1.95.1; litellm >= 1.96.0, < 1.96.2. Upgrade to 1.88.6 / 1.89.7 / 1.90.7 / 1.91.5 / 1.92.2 / 1.93.2 / 1.94.3 / 1.95.1 / 1.96.2 or later.

securitycveghsa

Sep 30, 2026 litellm < 1.88.6; litellm >= 1.89.0, < 1.89.7; litellm >= 1.90.0, < 1.90.7; litellm >= 1.91.0, < 1.91.5; litellm >= 1.92.0, < 1.92.2; litellm >= 1.93.0, < 1.93.2; litellm >= 1.94.0, < 1.94.3

CanonicalSecurity

CVE-2026-26268: Cursor sandbox escape via git hooks

Cursor’s agent could write to .git/hooks/ — planted hook scripts execute on the next commit/push/checkout with full OS privileges, no further prompt needed. Fixed in 2.5; the class persists in every file-writing agent.

securityincidentcve

Sep 28, 2026 1

CanonicalSecurity

CVE and dependency monitoring for agent-driven repos

Continuous (not incident-driven) monitoring: lockfiles committed, automated alerts, reachability triage, and agents that propose PRs with tests — not 3am bulk bumps.

securitycvedependencies

Sep 22, 2026 2

CanonicalSecurity