Daily · · Pydantic AI · 🌶️🌶️🌶️Act nowSpicy: act now (security, deadline, breaking, big launch) Why: Security fix
Pydantic AI patches a High web_fetch bug
Pydantic AI users, update now: a High-severity fix stops crafted web pages from tying up your app. When web_ fetched attacker-controlled HTML with many elements, converting it could delay unrelated work in the same process.
The maintainers published the fix on Oct 21, 2026: upgrade to 2.59.0, or 1.107.9 on v1.
What changed
One booby-trapped web page shouldn’t hold up the rest of your agent’s work.
Pydantic AI is a Python framework for building AI agents. Its web_ lets an agent fetch a web page and convert its HTML.
What went wrong
Converting a page packed with HTML elements could keep a worker busy for an extended period. Several of those fetches at once could fill the shared worker pool, so other operations had to wait. Earlier affected versions did the conversion on the event loop itself.
It only matters if your app points the tool at HTML whose content an attacker can influence. On v2, every release from 2.0.0 up to the fix is affected. On v1, only releases from 1.77.0 up to the fix are affected.
What to do
- Upgrade
pydantic-aiorpydantic-ai-slimto 2.59.0, or to 1.107.9 if you’re on v1. A later release on the same line works too. - Can’t upgrade yet? Don’t let
web_fetch HTML an attacker controls until you can.fetch_ tool
Source: Pydantic AI web_fetch security advisory, Oct 21, 2026 · Pydantic AI v2.59.0 release notes · Pydantic AI v1.107.9 release notes