Read the docs
TI-2026-78767 Aliases CVE-2026-114386GHSA-3589-pxp7-3gj8

Tool call limit bypass in Pydantic AI CodeMode run_code

Priority LOW 28CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Pydantic AI before 0.59.0 fails to enforce tool call limits on nested tool calls made from run_code in the CodeMode toolset, a missing resource limit (CWE-770). A user, or prompt-injected content, can make the sandboxed program invoke tools without the usage check, exceeding operator limits on costly or side-effecting tools.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed pydantic-ai-harness (pydantic): 0.59.0pydantic-ai-harness (PyPI): 0.59.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai-harnessbefore 0.59.00.59.0Patch availableCNA
—pydantic-ai-harness (PyPI)before 0.59.00.59.0Patch availableGHSA-3589-pxp7-3gj8
  • pydantic-ai-harness Vendorpydantic Affected before 0.59.0 Fixed in 0.59.0 Patch available CNA
  • pydantic-ai-harness (PyPI) Vendor— Affected before 0.59.0 Fixed in 0.59.0 Patch available GHSA-3589-pxp7-3gj8

Remediation

Upgrade to version 0.59.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA pydantic-ai-harness (pydantic) Fixed in 0.59.0
  • Fix · GHSA-3589-pxp7-3gj8 pydantic-ai-harness (PyPI) Fixed in 0.59.0 Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114386
  2. 2026-10-21 Alias added: GHSA-3589-pxp7-3gj8
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: MEDIUM → LOW
  5. 2026-10-23 Fix available: PyPI/[email protected] · GHSA-3589-pxp7-3gj8
  6. 2026-10-23 CVSS score added · GHSA-3589-pxp7-3gj8
  7. 2026-10-23 Weakness changed · GHSA-3589-pxp7-3gj8
  8. 2026-10-23 7 new references · GHSA-3589-pxp7-3gj8

References

Patch 2

Advisory 1

Other 5

  • TI-2024-03518 Regular expression denial of service in Pydantic < 2.4.0 CVSS 3.1HIGH 7.5
  • TI-2026-57990 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers CVSS 3.1MEDIUM 5.3
  • TI-2026-41916 Path traversal in pydantic-settings CVSS 3.1MEDIUM 5.3
  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-57993 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) CVSS 3.1HIGH 7.5
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences