A path traversal vulnerability in Pydantic AI versions 1.34.0 through 1.50.9 allows unauthenticated remote attackers to execute malicious code in a user's browser, posing a high risk of data theft.

The vulnerability exists in the web UI component, where the application constructs a CDN URL using an unvalidated version query parameter. This enables an unauthenticated attacker to inject path traversal sequences, forcing the server to serve attacker-controlled HTML or JavaScript instead of the intended chat interface.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of the user's browser session. This can lead to the exfiltration of sensitive chat history and other client-side data. With a CVSS score of 7.1, this represents a significant risk to the confidentiality of user interactions, particularly in deployments where the Pydantic AI interface is exposed to external networks.

Immediate Action: Update the pydantic-ai and pydantic-ai-slim packages to version 1.51.0 or later immediately.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing path traversal sequences or unexpected characters within the version query parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming requests and block those containing path traversal patterns or suspicious query parameter inputs.

Public Exploit Available: Unknown

This vulnerability presents a clear risk of unauthorized data access via client-side code execution. Organizations utilizing Pydantic AI to host chat interfaces are urged to prioritize the update to version 1.51.0. Given the potential for session data theft, remediation should be completed as soon as possible to ensure the integrity of the application environment.