---
id: "GHSA-qpmf-fgh3-ff25"
page: "https://infrastack.ai/live/GHSA-qpmf-fgh3-ff25"
kind: "vulnerability"
aliases: ["GHSA-qpmf-fgh3-ff25"]
title: "Validation bypass of extra data keys in JSON model validation"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pydantic", "fixed": ["2.14.2"], "affected": ">= 2.13.0, < 2.14.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["backend", "cwe-20", "package", "pydantic", "python"]
not_affected_if: ["extra-forbid-or-ignore", "no-constrained-extra-keys", "python-mode-validation"]
published_at: "2026-10-29T17:01:40+00:00"
first_seen_at: "2026-11-09T22:53:21+00:00"
updated_at: "2026-11-09T22:54:57+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/pydantic/pydantic/security/advisories/GHSA-qpmf-fgh3-ff25", "first_seen_at": "2026-11-09T22:53:21+00:00"}]
exploit_sources: []
---

# Validation bypass of extra data keys in JSON model validation

Link for people: https://infrastack.ai/live/GHSA-qpmf-fgh3-ff25 (this .md is for agents)

When Pydantic validates JSON into a model with extra='allow', it stores extra keys without checking them against the key type declared on __pydantic_extra__. Extra data can therefore hold keys that do not match the declared type, bypassing validation for untrusted JSON input.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pydantic affected >= 2.13.0, < 2.14.2 fixed 2.14.2

## How to check

- Check the installed version with `pip show pydantic` and see whether it falls in `>= 2.13.0, < 2.14.2`.
- Search the codebase for `extra='allow'` or `extra = "allow"` on models that validate JSON, and for `__pydantic_extra__` annotated with a constrained key type such as `dict[Annotated[str, Field(pattern=...)], ...]`.

## Fix

- pydantic: upgrade to `2.14.2`

## Timeline

- 2026-11-09T22:53:21+00:00 ghsa-repo https://github.com/pydantic/pydantic/security/advisories/GHSA-qpmf-fgh3-ff25

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/pydantic/pydantic/security/advisories/GHSA-qpmf-fgh3-ff25

## From the sources

### Summary

When validating JSON data into a model allowing extra data, the keys of extra data aren't validated against the key type annotated on `__pydantic_extra__`, resulting in extra data not matching the declared type. This is the case if you define `__pydantic_extra__` as e.g. `dict[Annotated[str, Field(pattern=r'^x_')], int]`.

### Details

The [`validate_json_by_iteration()`](https://github.com/pydantic/pydantic/blob/v2.13.5/pydantic-core/src/validators/model_fields.rs#L540) method (in [`pydantic-core/src/validators/model_fields.rs`](https://github.com/pydantic/pydantic/blob/v2.13.5/pydantic-core/src/validators/model_fields.rs)), used to validate JSON data into models, only validates the values of extra data, and stores the keys as is ([L605-L623](https://github.com/pydantic/pydantic/blob/v2.13.5/pydantic-core/src/validators/model_fields.rs#L605-L623)):

```rust
ExtraBehavior::Allow => {
    // the key is stored as is, without being validated:
    let py_key: Bound<'_, PyString> = new_py_string(py, key, state.cache_str());
    if let Some(validator) = &self.extras_validator {
        match validator.validate(py, value, state) {
            Ok(value) => {
                model_extra_dict.set_item(&py_key, value)?;
                fields_set.add(py_key)?;
            }
            // ...
        }
    }
    // ...
}
```

Python mode validation isn't affected.

The issue was fixed in commit https://github.com/pydantic/pydantic/commit/4c65dbda9970a488e2ff21c8693fc6f6d70a3358.

### Impact

Validation bypass: extra data returned by validation doesn't match the declared type. Affected are applications validating untrusted JSON data into models allowing extra data (with `extra='allow'`), with a key type annotated on `__pydantic_extra__` (e.g. `dict[Annotated[str, Field(pattern=...)], int]`), using Pydantic from 2.13.0 up to (but excluding) 2.14.2.

Python mode validation isn't affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_