CVE-2026-114386: Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.toolcallslimit on nested tool calls dispatched from runcode in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via runnestedcall() without checkbeforetoolcall, exceeding operator limits on costly or side-effecting tools.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pydantic AI Harnessto a version that resolves this vulnerability.Fixed in 0.59.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Pydantic AI Harness before 0.59.0 are exposed when they use the CodeMode toolset and rely on UsageLimits.tool_calls_limit to constrain tool invocations. The impact is most relevant where callable tools are costly or have side effects.
What does an attacker need to exploit it?
No authentication or user interaction is required according to the supplied vector, but exploitation has high attack complexity. An attacker-controlled user input or prompt-injected content must cause a sandboxed program to invoke tools through run_nested_call() from run_code.
Are default tool-call limits sufficient to prevent exploitation?
No, a configured UsageLimits.tool_calls_limit is bypassed for nested calls dispatched through run_code because check_before_tool_call is not enforced on that path. Nested calls can therefore exceed the operator's intended limit.
What is the remediation?
Upgrade Pydantic AI Harness to version 0.59.0 or later. The issue affects versions before 0.59.0.