Pydantic AI v2.66.0 (2026-11-04)
Pydantic AI v2.66.0 addresses multiple security vulnerabilities, including high-severity DoS issues from JSON expansion and regex backtracking, SSRF via Tencent Cloud metadata, data leakage via OpenTelemetry traces, schema-inlining DoS, and arbitrary file reconstruction risks.
Why this signal matters
Pydantic AI v2.66.0 fixes numerous security issues across core packages: (1) GHSA-m5vj-8mcw-82qx (high): WebFetch capability/tool expanded deeply nested JSON before applying content limits, leading to event loop blocking/memory exhaustion. (2) GHSA-mfx5-pc32-32m8 (high): Exponential backtracking in secret redaction private key patterns fixed in pydantic-ai-harness 0.66.0. (3) GHSA-5fj9-5pjw-vpwc (medium): Added Tencent Cloud instance metadata IP (169.254.0.23) to the download blocklist. (4) GHSA-jp94-mmr3-2pvv (medium): Prevented OpenTelemetry embedding spans from logging extra headers and body settings containing secrets. (5) GHSA-7494-925c-rrxv & GHSA-484x-x9m4-62cj (medium): Resolved recursive/exponential schema expansion attacks in AG-UI and DecisionModel tool handling. (6) GHSA-r879-rxgj-3g75 (medium): Fixed quadratic processing time when parsing multipart messages in Vercel AI and AG-UI adapters. (7) GHSA-4cj4-hgwf-4hc4 (medium): Mitigated insecure deserialization of tool result payloads mimicking internal file types that led to SSRF/unauthorized file reads. (8) GHSA-5ppx-9jq6-6pmw (low): Addressed DNS lookup leaks on refused hostnames prior to rejection. (9) GHSA-mgmv-r532-pg36 (medium): Documented earlier fix in v2.60.0 preventing credential leaks in MCP URL derived IDs sent to frontend adapters.
Actionable summary
Security release Pydantic AI v2.66.0 and backports patch GHSA-m5vj-8mcw-82qx, GHSA-mfx5-pc32-32m8, GHSA-5fj9-5pjw-vpwc, GHSA-jp94-mmr3-2pvv, GHSA-7494-925c-rrxv, GHSA-484x-x9m4-62cj, GHSA-r879-rxgj-3g75, GHSA-4cj4-hgwf-4hc4, GHSA-5ppx-9jq6-6pmw, and previously resolved GHSA-mgmv-r532-pg36 across pydantic-ai, pydantic-ai-slim, and pydantic-ai-harness.
- Agent usefulness
- 92/100
- Confidence
- 96%
- Canonical data
- JSON + Markdown
What builders should check
- Upgrade pydantic-ai and pydantic-ai-slim to v2.66.0 or v1.107.10.
- Upgrade pydantic-ai-harness to 0.66.0 if using secret redaction or Playwright egress policies.
- Rotate any credentials passed via embedding extra headers/body if OpenTelemetry instrumentation was active, and restrict access to historical traces.
- Verify tool output validation if utilizing persistent conversation history with Temporal, DBOS, Prefect, or UI adapters.