6.3
Moyenne
CVE-2026-114386 Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from…
Description
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| pydantic-ai-harness 0.59 | premières → < 0.59.0 | 0.59.0 |