| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| pydantic-ai | ≥ 1.77.0, < 1.107.7≥ 2.0.0b1, < 2.52.0 | 1.107.72.52.0 |
| pydantic-ai-slim | ≥ 1.77.0, < 1.107.7≥ 2.0.0b1, < 2.52.0 | 1.107.72.52.0 |
| pydantic ai | ≥ 1.77.0, < 1.107.7≥ 2.0.0, < 2.52.0 | 1.107.72.52.0 |
Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected.
Nested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop.
Upgrade to a patched release of pydantic-ai or pydantic-ai-slim. If you cannot upgrade yet, avoid using local web fetching for attacker-controlled HTML.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí