GHSA-2jrp-274c-jhv3: Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
SummaryA Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials.**This vulnerability only affects applications that accept message history from external users**, such as those using:**`Agent.to_web`** or **`clai web`** to serve a chat interface**`VercelAIAdapter`** for Vercel AI SDK integration**`AGUIAdapter`** or **`Agent.to_ag_ui`** for AG-UI protocol integrationCustom APIs that accept message history from user inputApplications that only use hardcoded or developer-controlled URLs are not affected.DescriptionThe `download_item()` helper function downloads content from URLs without validating that the target is a public internet address. When user-supplied message history contains URLs, attackers can:**Access internal services**: Request `http://127.0.0.1`, `localhost`, or private IP ranges (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`)**Steal cloud credentials**: Access cloud metadata endpoints (AWS IMDSv1 at `169.254.169.254`, GCP, Azure, Alibaba Cloud)**Scan internal networks**: Enumerate internal hosts and portsWho Is AffectedYou are affected if your application:**Uses `Agent.to_web` or `clai web`** - The web interface accepts file attachments via the Vercel AI Data Stream Protocol, where users can provide arbitrary URLs through chat messages.**Uses `VercelAIAdapter`** - Chat interfaces built with Vercel AI SDK allow users to submit messages containing URLs that are processed server-side.**Uses `AGUIAdapter` or `Agent.to_ag_ui`** - The AG-UI protocol allows users to provide file references with URLs as part of agent interactions.**Exposes a custom API accepting message history** - Any endpoint that accepts message history or `ImageUrl`, `AudioUrl`, `VideoUrl`, `DocumentUrl` objects from user input.Attack ScenarioVia chat interface, an attacker submits a message with a file attachment pointing to an internal resource:Affected Model IntegrationsMultiple model integrations download URL content in certain conditions:| Provider | Downloaded Types |
|----------|------------------|
| `OpenAIChatModel` | `AudioUrl`, `DocumentUrl` |
| `AnthropicModel` | `DocumentUrl` (`text/plain`) |
| `GoogleModel` (GLA) | All URL types (except YouTube and Files API URLs) |
| `XaiModel` | `DocumentUrl` |
| `BedrockConverseModel` | `ImageUrl`, `DocumentUrl`, `VideoUrl` (non-S3 URLs) |
| `OpenRouterModel` | `AudioUrl` |RemediationUpgrade to Patched Version**Upgrade** to the patched version or later. The fix adds comprehensive SSRF protection:Blocks private/internal IP addresses by defaultAlways blocks cloud metadata endpoints (even with `allow-local`)Only allows `http://` and `https://` protocolsResolves hostnames before requests to prevent DNS rebindingValidates each redirect targetNew `force_download='allow-local'` OptionIf an application legitimately needs to access local/private network resources (e.g., in a fully trusted internal environment), it can explicitly opt in:**Important**: Cloud metadata endpoints (`169.254.169.254`, `fd00:ec2::254`, `100.100.100.200`) are **always blocked**, even with `allow-local`.Workaround for Older VersionsIf a project cannot upgrade immediately, use a [history processor](https://ai.pydantic.dev/message-history/#processing-message-history) to filter out URLs targeting local/private addresses:Technical Details of the FixThe fix introduces a new `_ssrf.py` module with comprehensive protection:**Protocol validation**: Only `http://` and `https://` allowed**DNS resolution before request**: Prevents DNS rebinding attacks**Private IP blocking** (by default):`127.0.0.0/8`, `::1/128` (loopback)`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (private)`169.254.0.0/16`, `fe80::/10` (link-local)`100.64.0.0/10` (CGNAT)`fc00::/7` (unique local)`2002::/16` (6to4, can embed private IPv4)**Cloud metadata always blocked**: `169.254.169.254`, `fd00:ec2::254`, `100.100.100.200`**Safe redirect handling**: Each redirect validated before following (max 10)
CVSS v3.1: 8.6