---
id: "CVE-2026-54249"
kind: "vulnerability"
aliases: ["CVE-2026-54249", "GHSA-h7p7-w5gc-xj3w"]
title: "Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials"
severity: "medium"
cvss: 6.800000190734863
epss: 0.0031500000040978193
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "pydantic-ai-slim", "fixed": ["1.106.0"], "affected": ">= 1.65.0, < 1.106.0", "ecosystem": "pypi"}, {"name": "pydantic-ai-slim", "fixed": ["2.0.0b6"], "affected": ">= 2.0.0b1, < 2.0.0b6", "ecosystem": "pypi"}, {"name": "pydantic-ai", "fixed": ["1.106.0"], "affected": ">= 1.65.0, < 1.106.0", "ecosystem": "pypi"}, {"name": "pydantic-ai", "fixed": ["2.0.0b6"], "affected": ">= 2.0.0b1, < 2.0.0b6", "ecosystem": "pypi"}, {"name": "pydantic ai", "fixed": ["1.105.0"], "affected": ">= 1.65.0, < 1.105.0", "ecosystem": "vendor"}, {"name": "pydantic ai", "fixed": [], "affected": "= 2.0.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["ai-tooling", "cloud-storage", "cwe-918", "model-provider", "pydantic-ai", "python", "vercel-ai-adapter"]
not_affected_if: ["default-config", "no-ui-adapter", "trusted-message-history"]
published_at: "2026-07-29T21:17:47+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h7p7-w5gc-xj3w", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54249", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Pydantic AI UI adapters forward client-submitted UploadedFile references (provider file IDs or s3:// and gs:// URIs) to the model provider without validation. An attacker who can submit message history can make the server's own credentials fetch files the attacker should not read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pydantic-ai-slim affected >= 1.65.0, < 1.106.0 fixed 1.106.0
- pypi:pydantic-ai-slim affected >= 2.0.0b1, < 2.0.0b6 fixed 2.0.0b6
- pypi:pydantic-ai affected >= 1.65.0, < 1.106.0 fixed 1.106.0
- pypi:pydantic-ai affected >= 2.0.0b1, < 2.0.0b6 fixed 2.0.0b6
- vendor:pydantic ai affected >= 1.65.0, < 1.105.0 fixed 1.105.0
- vendor:pydantic ai affected = 2.0.0 fixed ?

## How to check

Check the pydantic-ai-slim or pydantic-ai version in the lockfile or pip freeze; affected if >=1.65.0 <1.106.0 or >=2.0.0b1 <2.0.0b6.

## Fix

Upgrade pydantic-ai-slim and pydantic-ai to 1.106.0 (1.x line) or 2.0.0b6 (2.x beta line).
If upgrade is not possible, stop passing untrusted client message history to the agent or strip UploadedFile parts from incoming messages.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-h7p7-w5gc-xj3w
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54249

## From the sources

### Summary

A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.

### Details

UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.

Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client's, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.

### Impact

Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.

### Patches

Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` references on client-submitted messages the same way file URLs are validated.

### Workarounds

If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip `UploadedFile` parts from incoming messages before running the agent.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_