CVE-2026-114386
- Source
- https://cve.org/CVERecord?id=CVE-2026-114386
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114386.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-114386
- Published
- 2026-10-21T12:39:43Z
- Modified
- 2026-10-22T10:30:31Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
- Details
-
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114386.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "0.59.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }, { "extracted_events": [ { "range": [ { "fixed": "0.59.0" } ], "source": "DESCRIPTION" } ] } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114386.json
- https://github.com/pydantic/pydantic-ai
- https://github.com/pydantic/pydantic-ai/blob/v2.58.0/src/pydantic_ai_harness/pydantic_ai_harness/code_mode/_toolset.py#L642-L680
- https://github.com/pydantic/pydantic-ai/commit/eb27b2b89fe76ae23ee9b6fc9eb4b227a4967949
- https://github.com/pydantic/pydantic-ai/pull/10362
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.59.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-114386
- https://pypi.org/project/pydantic-ai-harness/0.59.0/
- https://www.vulncheck.com/advisories/pydantic-ai-harness-before-0.59.0-codemode-tool-call-limit-bypass-via-run-code
Affected packages
Git / github.com/pydantic/pydantic-ai
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pydantic/pydantic-ai
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "fixed": "eb27b2b89fe76ae23ee9b6fc9eb4b227a4967949" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v2.59.0", "range": [ { "fixed": "5cdf4e2f946043db9c55445b8ed53f3b52fa8a0f" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
Other
clai2-bleeding
v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.2
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.0.27
v0.0.28
v0.0.29
v0.0.3
v0.0.30
v0.0.31
v0.0.32
v0.0.33
v0.0.34
v0.0.35
v0.0.36
v0.0.37
v0.0.38
v0.0.39
v0.0.4
v0.0.40
v0.0.41
v0.0.42
v0.0.43
v0.0.44
v0.0.45
v0.0.46
v0.0.47
v0.0.48
v0.0.49
v0.0.5
v0.0.50
v0.0.51
v0.0.52
v0.0.53
v0.0.54
v0.0.55
v0.0.6
v0.0.6a4
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.2.19
v0.2.2
v0.2.20
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.8.0
v0.8.1
v1.*
v1.0.0
v1.0.0b1
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.10.0
v1.100.0
v1.101.0
v1.102.0
v1.103.0
v1.104.0
v1.105.0
v1.106.0
v1.107.0
v1.11.0
v1.11.1
v1.12.0
v1.13.0
v1.14.0
v1.14.1
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.25.1
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.39.1
v1.4.0
v1.40.0
v1.41.0
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.5.0
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.57.0
v1.58.0
v1.59.0
v1.6.0
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.64.0
v1.65.0
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.7.0
v1.70.0
v1.72.0
v1.73.0
v1.74.0
v1.75.0
v1.76.0
v1.77.0
v1.78.0
v1.79.0
v1.8.0
v1.80.0
v1.81.0
v1.82.0
v1.83.0
v1.84.0
v1.84.1
v1.85.0
v1.85.1
v1.86.0
v1.86.1
v1.87.0
v1.88.0
v1.89.0
v1.89.1
v1.9.0
v1.9.1
v1.90.0
v1.91.0
v1.92.0
v1.93.0
v1.94.0
v1.95.0
v1.95.1
v1.96.0
v1.96.1
v1.97.0
v1.98.0
v1.99.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.27.1
v2.28.0
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.31.1
v2.32.0
v2.32.1
v2.32.2
v2.33.0
v2.34.0
v2.35.0
v2.35.1
v2.35.3
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.49.0
v2.5.0
v2.5.1
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.54.0
v2.55.0
v2.56.0
v2.57.0
v2.58.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v2.9.1