News · Use it
pydantic-ai 2.30.0 / 1.107.5 · Host-header fix on local web UI
Second security patch this week for Agent.to_web() / clai web: no Host validation meant DNS rebinding from a page you visit could reach the local agent and its tools. Fixed by allowing localhost/loopback/LAN by default; real hostnames need allowed_hosts. GHSA-q2xc-rrxj-58x9.4
Relevant to: anyone who runs the pydantic-ai dev web chat on a workstation
What the verdict meansAvailable, works, worth your time today.
Sources
Originally part of the 14 August 2026 edition.