PYDANTIC · GHSA-r49w-vh47-r4hf · Package
FIX → 1.10.27
When a Pydantic V1 dataclass is configured to allow extra fields, passing a `__pydantic_initialised__` key makes Pydantic treat the instance as already validated. The field values are then not validated, so data can have a type different from the one declared.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that validate untrusted data into Pydantic V1 dataclasses configured with extra=Extra.allow are exposed. Applications on the V2 API without the pydantic.v1 namespace, or that use forbid/ignore for extra fields, are not affected by the described bypass.
Not affected if extra-forbid-or-ignore, no-untrusted-input, pydantic-v2-native-api
Who cares pydantic, pydantic-v1, python
pip show pydantic; affected versions are >= 1.10.0 and < 1.10.26.extra=Extra.allow (or Extra.allow in a Config) that validate untrusted input.Upgrade to 1.10.27
When extra data is allowed, providing a __pydantic_initialised__ key when validating a Pydantic V1 dataclass makes it considered as already validated, resulting in field values not being validated.
When extra data is allowed, the __init__() method of Pydantic V1 dataclasses stores all the provided keyword arguments in the instance __dict__ before validation (pydantic/dataclasses.py):
elif config.extra == Extra.allow:
for k, v in kwargs.items():
self.__dict__.setdefault(k, v)
init(self, *args, **{k: v for k, v in kwargs.items() if k in self.__dataclass_fields__})
A __pydantic_initialised__ keyword argument thus overrides the internal flag used to skip validation of already validated instances ():
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.10.27.pydantic.v1 namespace under Pydantic V2, upgrade to 2.14.2 or later.def _dataclass_validate_values(self: 'Dataclass') -> None:
# validation errors can occur if this function is called twice on an already initialised dataclass.
# for example if Extra.forbid is enabled, it would consider __pydantic_initialised__ an invalid extra property
if getattr(self, '__pydantic_initialised__'):
return
The issue was fixed in commit https://github.com/pydantic/pydantic/commit/b26913fe6, published in V1.10.27.
If you are relying on the pydantic.v1 namespace in Pydantic V2, upgrade to V2.14.2 or later.
Validation bypass: data returned by validation doesn't match the declared type. Affected are applications validating untrusted data into Pydantic V1 dataclasses allowing extra data (with extra=Extra.allow).