Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

pydantic-ai-harness

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3PyPIAmendedPublished

    Pydantic AI Harness tool-call limit bypass in nested CodeMode calls

    CVE-2026-114386 · GHSA-3589-pxp7-3gj8

    Affected
    • PyPI pydantic-ai-harness < 0.59.0
    Fixed in
    0.59.0· Vendor fix available
    Issue
    Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall() without checkbeforetoolcall, exceeding operator limits on costly or side-effecting tools.

    Recommended action: Upgrade to 0.59.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →