{"id":"GHSA-r49w-vh47-r4hf","kind":"vulnerability","aliases":["GHSA-r49w-vh47-r4hf"],"related":[],"title":"Validation bypass of Pydantic V1 dataclasses allowing extra data","description":"### Summary\r\n\r\nWhen extra data is allowed, providing a `__pydantic_initialised__` key when validating a Pydantic V1 dataclass makes it considered as already validated, resulting in field values not being validated.\r\n\r\n### Details\r\n\r\nWhen extra data is allowed, the `__init__()` method of Pydantic V1 dataclasses stores all the provided keyword arguments in the instance `__dict__` before validation ([`pydantic/dataclasses.py`](https://github.com/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#L295-L298)):\r\n\r\n```python\r\nelif config.extra == Extra.allow:\r\n    for k, v in kwargs.items():\r\n        self.__dict__.setdefault(k, v)\r\n    init(self, *args, **{k: v for k, v in kwargs.items() if k in self.__dataclass_fields__})\r\n```\r\n\r\nA `__pydantic_initialised__` keyword argument thus overrides the internal flag used to skip validation of already validated instances ([`pydantic/dataclasses.py`](https://github.com/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#L430-L434)):\r\n\r\n```python\r\ndef _dataclass_validate_values(self: 'Dataclass') -> None:\r\n    # validation errors can occur if this function is called twice on an already initialised dataclass.\r\n    # for example if Extra.forbid is enabled, it would consider __pydantic_initialised__ an invalid extra property\r\n    if getattr(self, '__pydantic_initialised__'):\r\n        return\r\n```\r\n\r\nThe issue was fixed in commit https://github.com/pydantic/pydantic/commit/b26913fe6, published in V1.10.27.\r\n\r\nIf you are relying on the `pydantic.v1` namespace in Pydantic V2, upgrade to [V2.14.2](https://github.com/pydantic/pydantic/releases/tag/v2.14.2) or later.\r\n\r\n### Impact\r\n\r\nValidation bypass: data returned by validation doesn't match the declared type. Affected are applications validating untrusted data into Pydantic V1 dataclasses allowing extra data (with `extra=Extra.allow`).","summary":"When a Pydantic V1 dataclass is configured to allow extra fields, passing a `__pydantic_initialised__` key makes Pydantic treat the instance as already validated. The field values are then not validated, so data can have a type different from the one declared.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pydantic","note":">=1.10.0, <1.10.26","fixed":["1.10.27"],"affected":">= 1.10.0, < 1.10.26","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-20","package","pydantic","pydantic-v1","python"],"not_affected_if":["extra-forbid-or-ignore","no-untrusted-input","pydantic-v2-native-api"],"how_to_check":"- Check the installed version with `pip show pydantic`; affected versions are `>= 1.10.0` and `< 1.10.26`.\n- Search the code for dataclasses using `extra=Extra.allow` (or `Extra.allow` in a Config) that validate untrusted input.","fix":"- Upgrade pydantic (V1 line) to `1.10.27`.\n- If you use the `pydantic.v1` namespace under Pydantic V2, upgrade to `2.14.2` or later.","status":"open","published_at":"2026-10-29T16:57:43+00:00","first_seen_at":"2026-11-09T22:53:21+00:00","triaged_at":"2026-11-09T22:54:57+00:00","updated_at":"2026-11-09T22:54:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:54:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pydantic (V1 line) to `1.10.27`.\n- If you use the `pydantic.v1` namespace under Pydantic V2, upgrade to `2.14.2` or later.","reach":"unknown","title":"Pydantic: crafted key skips validation of V1 dataclasses that allow extra data","impact":"low","summary":"When a Pydantic V1 dataclass is configured to allow extra fields, passing a `__pydantic_initialised__` key makes Pydantic treat the instance as already validated. The field values are then not validated, so data can have a type different from the one declared.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pydantic","pydantic-v1"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unvalidated fields with wrong types reach application logic","analyst_note":"","how_to_check":"- Check the installed version with `pip show pydantic`; affected versions are `>= 1.10.0` and `< 1.10.26`.\n- Search the code for dataclasses using `extra=Extra.allow` (or `Extra.allow` in a Config) that validate untrusted input.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["extra-forbid-or-ignore","no-untrusted-input","pydantic-v2-native-api"],"who_is_affected":"Only applications that validate untrusted data into Pydantic V1 dataclasses configured with extra=Extra.allow are exposed. Applications on the V2 API without the pydantic.v1 namespace, or that use forbid/ignore for extra fields, are not affected by the described bypass.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000828,"input_tokens":5238,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-20':22B '/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l295-l298)):':129C '/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l430-l434)):':177C '/pydantic/pydantic/commit/b26913fe6,':230C '/pydantic/pydantic/releases/tag/v2.14.2)':250C 'affect':266C 'allow':7A,37B,76C,106C,276C 'alreadi':51B,92C,171C,198C 'applic':268C 'arg':144C 'argument':119C,160C 'bypass':2A,255C 'call':194C 'commit':227C 'config.extra':132C 'configur':35B 'consid':90C,209C 'cwe':21B 'data':9A,61B,74C,104C,256C,271C,278C 'dataclass':6A,33B,87C,113C,180C,184C,200C,275C 'declar':70B,264C 'def':179C 'detail':101C 'dict':123C 'differ':66B 'doesn':260C 'elif':131C 'enabl':206C 'error':187C 'exampl':202C 'extra':8A,38B,73C,103C,214C,277C,280C 'extra.allow':133C,281C 'extra.forbid':204C 'field':39B,54B,96C 'fix':225C 'flag':165C 'function':192C 'getattr':217C 'ghsa':11A,16A 'ghsa-r49w-vh47-r4hf':10A,15A 'github.com':128C,176C,229C,249C 'github.com/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l295-l298)):':127C 'github.com/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l430-l434)):':175C 'github.com/pydantic/pydantic/commit/b26913fe6,':228C 'github.com/pydantic/pydantic/releases/tag/v2.14.2)':248C 'impact':253C 'init':108C,142C 'initialis':43B,80C,158C,199C,211C,220C 'instanc':49B,122C,173C 'intern':164C 'invalid':213C 'issu':223C 'k':135C,140C,145C,148C,153C 'key':44B,81C 'keyword':118C,159C 'kwargs.items':138C,151C 'later':252C 'make':45B,88C 'match':262C 'method':109C 'namespac':241C 'none':185C 'occur':189C 'one':69B 'overrid':162C 'packag':23B 'pass':40B 'properti':215C 'provid':77C,117C 'publish':231C 'pydant':4A,24B,26B,31B,42B,46B,79C,85C,111C,157C,210C,219C,243C,273C 'pydantic':20A 'pydantic-v1':25B 'pydantic.v1':240C 'pydantic/dataclasses.py':126C,174C 'python':28B,130C,178C 'r49w':12A,17A 'r4hf':14A,19A 'reli':237C 'result':94C 'return':221C,257C 'self':143C,183C,218C 'self.__dataclass_fields__':155C 'self.__dict__.setdefault':139C 'skip':168C 'store':114C 'summari':71C 'thus':161C 'treat':47B 'twice':195C 'type':65B,265C 'untrust':270C 'upgrad':245C 'use':166C 'v':136C,141C,146C,149C 'v1':5A,27B,32B,86C,112C,274C 'v1.10.27':233C 'v2':244C 'v2.14.2':247C 'valid':1A,52B,59B,83C,93C,100C,125C,169C,172C,181C,186C,254C,259C,269C 'valu':55B,97C,182C 'vh47':13A,18A 'would':208C","nicknames":[],"mitigations":[],"who_affected":"Only applications that validate untrusted data into Pydantic V1 dataclasses configured with extra=Extra.allow are exposed. Applications on the V2 API without the pydantic.v1 namespace, or that use forbid/ignore for extra fields, are not affected by the described bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["pydantic"],"ptokens":["pydantic"],"labels":["cwe20","medium","package","pydantic","pydanticv1","pypi","python"],"campaign_type":null,"search_a":"'allow':7A 'bypass':2A 'data':9A 'dataclass':6A 'extra':8A 'ghsa':11A,16A 'ghsa-r49w-vh47-r4hf':10A,15A 'pydant':4A 'pydantic':20A 'r49w':12A,17A 'r4hf':14A,19A 'v1':5A 'valid':1A 'vh47':13A,18A","search_b":"'-20':22B 'allow':37B 'alreadi':51B 'configur':35B 'cwe':21B 'data':61B 'dataclass':33B 'declar':70B 'differ':66B 'extra':38B 'field':39B,54B 'initialis':43B 'instanc':49B 'key':44B 'make':45B 'one':69B 'packag':23B 'pass':40B 'pydant':24B,26B,31B,42B,46B 'pydantic-v1':25B 'python':28B 'treat':47B 'type':65B 'v1':27B,32B 'valid':52B,59B 'valu':55B","search_c":"'/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l295-l298)):':129C '/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l430-l434)):':177C '/pydantic/pydantic/commit/b26913fe6,':230C '/pydantic/pydantic/releases/tag/v2.14.2)':250C 'affect':266C 'allow':76C,106C,276C 'alreadi':92C,171C,198C 'applic':268C 'arg':144C 'argument':119C,160C 'bypass':255C 'call':194C 'commit':227C 'config.extra':132C 'consid':90C,209C 'data':74C,104C,256C,271C,278C 'dataclass':87C,113C,180C,184C,200C,275C 'declar':264C 'def':179C 'detail':101C 'dict':123C 'doesn':260C 'elif':131C 'enabl':206C 'error':187C 'exampl':202C 'extra':73C,103C,214C,277C,280C 'extra.allow':133C,281C 'extra.forbid':204C 'field':96C 'fix':225C 'flag':165C 'function':192C 'getattr':217C 'github.com':128C,176C,229C,249C 'github.com/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l295-l298)):':127C 'github.com/pydantic/pydantic/blob/v1.10.26/pydantic/dataclasses.py#l430-l434)):':175C 'github.com/pydantic/pydantic/commit/b26913fe6,':228C 'github.com/pydantic/pydantic/releases/tag/v2.14.2)':248C 'impact':253C 'init':108C,142C 'initialis':80C,158C,199C,211C,220C 'instanc':122C,173C 'intern':164C 'invalid':213C 'issu':223C 'k':135C,140C,145C,148C,153C 'key':81C 'keyword':118C,159C 'kwargs.items':138C,151C 'later':252C 'make':88C 'match':262C 'method':109C 'namespac':241C 'none':185C 'occur':189C 'overrid':162C 'properti':215C 'provid':77C,117C 'publish':231C 'pydant':79C,85C,111C,157C,210C,219C,243C,273C 'pydantic.v1':240C 'pydantic/dataclasses.py':126C,174C 'python':130C,178C 'reli':237C 'result':94C 'return':221C,257C 'self':143C,183C,218C 'self.__dataclass_fields__':155C 'self.__dict__.setdefault':139C 'skip':168C 'store':114C 'summari':71C 'thus':161C 'twice':195C 'type':265C 'untrust':270C 'upgrad':245C 'use':166C 'v':136C,141C,146C,149C 'v1':86C,112C,274C 'v1.10.27':233C 'v2':244C 'v2.14.2':247C 'valid':83C,93C,100C,125C,169C,172C,181C,186C,254C,259C,269C 'valu':97C,182C 'would':208C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T16:57:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-r49w-vh47-r4hf","url":"https://github.com/pydantic/pydantic/security/advisories/GHSA-r49w-vh47-r4hf","severity":"medium","published_at":"2026-10-29T16:57:43+00:00","modified_at":"2026-10-29T16:57:43+00:00","first_seen_at":"2026-11-09T22:53:21+00:00","fetched_at":"2026-11-09T22:53:21+00:00","note":null}],"documents":[{"id":110524,"url":"https://github.com/pydantic/pydantic/security/advisories/GHSA-r49w-vh47-r4hf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}