PydanticAI v1.107.3 修复高危跨站请求与日志脱敏漏洞

AI 摘要

PydanticAI 发布 v1.107.3 版本，修复了两个安全漏洞：一个高危漏洞允许跨站请求触发开发 Web 聊天 UI 中的代理执行工具，现已要求请求必须为 JSON 格式；另一个低危漏洞涉及重试提示内容未在日志中正确脱敏。两个漏洞在 v2 版本中也已修复。

正文节选

### 🛡️ Security This release backports two security fixes to the v1 line: - **[GHSA-h4xc-3qfq-jf93](https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h4xc-3qfq-jf93)** (high) — the development web chat UI's (`Agent.to_web()`, `clai web`) chat endpoint didn't check the request's content type, so a plain cross-origin request from a website open in the developer's browser could reach it without a CORS preflight and trigger the served agent to run and execute its tools with the loca

发布时间：2026-08-12 10:05

抓取时间：2026-08-12 10:59

来源机构：Pydantic