Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

Summary

A Path Traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling theft of chat history and other client-side data.

This vulnerability only affects applications that use:

• Agent.to_web to serve a chat interface
• clai web to serve a chat interface from the CLI

These are typically run locally (on localhost), but may also be deployed on a remote server.

Description

The web UI serves its frontend HTML by fetching it from a CDN. In affected versions, the CDN URL is constructed using a version query parameter from the request URL. This parameter is not validated, allowing path traversal sequences that cause the server to fetch and serve attacker-controlled HTML/JavaScript from an arbitrary source on the same CDN, instead of the legitimate chat UI package.

Who Is Affected

Projects are affected if your application uses Agent.to_web or clai web to serve the Pydantic AI chat interface.

Attack Scenario

1. An attacker crafts a URL pointing to the victim's Pydantic AI web UI instance (either localhost with the known port, or a remote server endpoint) with a malicious version query parameter containing path traversal sequences.

2. The attacker gets the victim to visit this URL — directly via a link, through a redirect, or by embedding it in an iframe.

3. When the victim's browser loads the page, the server fetches and serves attacker-controlled HTML/JavaScript instead of the legitimate chat UI.