Pydantic
GET security.pydantic.dev
CVE coordination
Prospective CNAPublic scope, reporting contact, disclosure policy, and advisory location for the Pydantic CVE Numbering Authority application.
Scope
Vulnerabilities in the open-source projects listed below, which Pydantic maintains.
- pydantic
- pydantic-settings
- pydantic-extra-types
- pydantic-ai
- logfire
- logfire-js
- logfire-rust
- logfire-mcp
- jiter
- monty
- genai-prices
The pydantic-ai repository includes pydantic-graph and pydantic-evals.
Supported and end-of-life releases are considered case by case. Pydantic defers to the supplier or another
CNA whenever it has more appropriate scope.
Reporting and public contact
Report vulnerabilities through the affected project's private reporting channel first. On GitHub, open the project's Security tab and use Report a vulnerability. Do not open a public issue.
If the project has no private reporting channel, or for CNA coordination, contact security@pydantic.dev.
Disclosure policy
Pydantic handles reports privately with the reporter and the maintainers of the affected project. Pydantic validates the issue, identifies affected versions, checks for duplicate CVE records, and coordinates a fix and a disclosure date.
A fix or mitigation should be available before or at disclosure whenever feasible. Published information includes affected and fixed versions, impact, mitigations, references, and reporter credit when requested. Timelines may be shortened for active exploitation or adjusted when necessary to protect users. The current CNA Operational Rules take precedence.
Advisory location
Formal advisories are published on the affected project's public GitHub security-advisory page and are indexed here after disclosure. Published advisories are readable without login.
No published advisories are currently listed.