Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

Attack Scenario

Via chat interface, an attacker submits a message with a file attachment pointing to an internal resource:

{
  "role": "user",
  "parts": [
    {"type": "file", "mediaType": "image/png", "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}
  ]
}

Affected Model Integrations

Multiple model integrations download URL content in certain conditions:

Remediation

Upgrade to Patched Version

Upgrade to the patched version or later. The fix adds comprehensive SSRF protection:

• Blocks private/internal IP addresses by default
• Always blocks cloud metadata endpoints (even with allow-local)
• Only allows http:// and https:// protocols
• Resolves hostnames before requests to prevent DNS rebinding
• Validates each redirect target

New force_download='allow-local' Option

If an application legitimately needs to access local/private network resources (e.g., in a fully trusted internal environment), it can explicitly opt in:

from pydantic_ai import ImageUrl

# Default behavior: private IPs are blocked
ImageUrl(url="http://internal-service/image.png")  # Raises ValueError

# Opt-in to allow local access (use with caution)
ImageUrl(url="http://internal-service/image.png", force_download='allow-local')

Important: Cloud metadata endpoints (169.254.169.254, fd00:ec2::254, 100.100.100.200) are always blocked, even with allow-local.

Workaround for Older Versions

If a project cannot upgrade immediately, use a history processor to filter out URLs targeting local/private addresses:

import ipaddress
import socket
from urllib.parse import urlparse

from pydantic_ai import Agent, ModelMessage, ModelRequest
from pydantic_ai.messages import AudioUrl, DocumentUrl, ImageUrl, VideoUrl

def is_private_url(url: str) -> bool:
    """Check if a URL targets a private/internal IP address."""
    try:
        parsed = urlparse(url)
        hostname = parsed.hostname
        if not hostname:
            return True  # Invalid URL, block it

        # Resolve hostname to IP
        ip_str = socket.gethostbyname(hostname)
        ip = ipaddress.ip_address(ip_str)

        # Block private, loopback, and link-local addresses
        return ip.is_private or ip.is_loopback or ip.is_link_local
    except (socket.gaierror, ValueError):
        return True  # DNS resolution failed, block it

def filter_private_urls(messages: list[ModelMessage]) -> list[ModelMessage]:
    """Remove URL parts that target private/internal addresses."""
    url_types = (ImageUrl, AudioUrl, VideoUrl, DocumentUrl)
    filtered = []
    for msg in messages:
        if isinstance(msg, ModelRequest):
            safe_parts = [
                part for part in msg.parts
                if not (isinstance(part, url_types) and is_private_url(part.url))
            ]
            if safe_parts:
                filtered.append(ModelRequest(parts=safe_parts))
        else:
            filtered.append(msg)
    return filtered

# Apply the filter to your agent
agent = Agent('openai:gpt-5', history_processors=[filter_private_urls])

Technical Details of the Fix

The fix introduces a new _ssrf.py module with comprehensive protection:

1. Protocol validation: Only http:// and https:// allowed
2. DNS resolution before request: Prevents DNS rebinding attacks
3. Private IP blocking (by default):
   • 127.0.0.0/8, ::1/128 (loopback)
   • 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (private)
   • 169.254.0.0/16, fe80::/10 (link-local)
   • 100.64.0.0/10 (CGNAT)
   • fc00::/7 (unique local)
   • 2002::/16 (6to4, can embed private IPv4)
4. Cloud metadata always blocked: 169.254.169.254, fd00:ec2::254, 100.100.100.200
5. Safe redirect handling: Each redirect validated before following (max 10)