{"id":"CVE-2026-114386","kind":"vulnerability","aliases":["CVE-2026-114386","GHSA-3589-pxp7-3gj8"],"related":[],"title":"Pydantic AI Harness tool-call limit bypass in nested CodeMode calls","description":"Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.","summary":"Pydantic AI Harness before 0.59.0 does not enforce the tool-call limit on tools invoked from nested calls inside its CodeMode sandbox. A user or prompt-injected content can make the sandboxed program call tools beyond the operator's configured limit, including costly or side-effecting ones.","severity":"medium","cvss":6.3,"epss":0.00346,"exploited":false,"exploited_at":null,"products":[{"name":"pydantic-ai-harness","fixed":["0.59.0"],"affected":"< 0.59.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-agents","ai-tooling","codemode","cwe-770","pydantic-ai","python"],"not_affected_if":["not-using-codemode","version-0.59.0-or-later"],"how_to_check":"Check whether the project pins pydantic-ai-harness below 0.59.0 (e.g. pip show pydantic-ai-harness or grep it in requirements/lock files).","fix":"Upgrade pydantic-ai-harness to 0.59.0 or later.","status":"open","published_at":"2026-10-21T13:18:28+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:26+00:00","updated_at":"2026-10-23T21:57:28+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-23T21:00:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade pydantic-ai-harness to 0.59.0 or later.\nUnknown whether a configuration workaround exists before upgrading.","reach":"unknown","impact":"medium","summary":"Pydantic AI Harness before 0.59.0 does not enforce the tool-call limit on tools invoked from nested calls inside its CodeMode sandbox. A user or prompt-injected content can make the sandboxed program call tools beyond the operator's configured limit, including costly or side-effecting ones.","category":"ai-tooling","who_cares":["python","pydantic-ai","ai-agents","codemode"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Tool-call limits bypassed, costly or side-effecting tools run beyond operator caps","analyst_note":"","how_to_check":"Check whether the project pins pydantic-ai-harness below 0.59.0 (e.g. pip show pydantic-ai-harness or grep it in requirements/lock files).\nUnknown whether CodeMode is needed to trigger it beyond use of run_code in the CodeMode toolset.\nunknown","needs_analyst":false,"not_affected_if":["not-using-codemode","version-0.59.0-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00052,"input_tokens":2872,"output_tokens":465,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114386':15A,23A '-2026':14A,22A '-3589':17A '-770':36B '0.59.0':45B,95C '3gj8':20A 'agent':30B 'ai':2A,26A,29B,32B,39B,42B,92C 'ai-ag':28B 'ai-tool':31B 'beyond':78B 'bypass':8A 'call':6A,12A,52B,59B,76B,100C,105C,130C,135C 'check':132C 'code':109C 'codemod':11A,34B,62B,112C 'configur':82B 'content':70B,119C 'cost':85B,140C 'cve':13A,21A 'cwe':35B 'dispatch':106C 'effect':89B,144C 'enforc':48B,98C 'exceed':136C 'fail':96C 'ghsa':16A 'har':3A,43B,93C 'harness':27A 'includ':84B 'inject':69B,118C 'insid':60B 'invok':56B,125C 'limit':7A,53B,83B,101C,138C 'make':72B,121C 'nest':10A,58B,103C,129C 'one':90B 'oper':80B,137C 'program':75B,124C 'prompt':68B,117C 'prompt-inject':67B,116C 'pxp7':19A 'pxp7-3gj8':18A 'pydant':1A,38B,41B,91C 'pydantic':25A 'pydantic-ai':37B 'pydantic-ai-harness':24A 'python':40B 'run':108C,128C 'sandbox':63B,74B,123C 'side':88B,143C 'side-effect':87B,142C 'tool':5A,33B,51B,55B,77B,104C,126C,134C,145C 'tool-cal':4A,50B 'toolset':113C 'usagelimits.tool':99C 'user':65B,114C 'via':127C 'without':131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3589-pxp7-3gj8","url":"https://github.com/advisories/GHSA-3589-pxp7-3gj8","severity":"medium","published_at":"2026-10-21T15:42:26+00:00","modified_at":"2026-10-23T20:55:51+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114386","severity":null,"published_at":"2026-10-21T13:18:28+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}