---
id: CVE-2026-114386
aliases:
  - GHSA-3589-pxp7-3gj8
title: Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
summary: Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
vendor: pydantic-ai-harness
product: pydantic-ai-harness
ecosystem: pip
affected:
  - pydantic-ai-harness < 0.59.0
patched:
  - pydantic-ai-harness 0.59.0
published: '2026-10-21'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T21:00:05.311948379Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3589-pxp7-3gj8'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114386'
  - url: 'https://github.com/pydantic/pydantic-ai/pull/10362'
  - url: >-
      https://github.com/pydantic/pydantic-ai/commit/eb27b2b89fe76ae23ee9b6fc9eb4b227a4967949
  - url: 'https://github.com/pydantic/pydantic-ai'
  - url: >-
      https://github.com/pydantic/pydantic-ai/blob/v2.58.0/src/pydantic_ai_harness/pydantic_ai_harness/code_mode/_toolset.py#L642-L680
  - url: 'https://github.com/pydantic/pydantic-ai/releases/tag/v2.59.0'
  - url: 'https://pypi.org/project/pydantic-ai-harness/0.59.0'
  - url: >-
      https://www.vulncheck.com/advisories/pydantic-ai-harness-before-0.59.0-codemode-tool-call-limit-bypass-via-run-code
  - url: 'https://github.com/advisories/GHSA-3589-pxp7-3gj8'
  - url: 'https://pypi.org/project/pydantic-ai-harness/0.59.0/'
tags:
  - osv
  - pip
  - ghsa
  - cve.org
epss: 0.00346
epssPercentile: 0.28347
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T19:55:43.280737Z'
cwe:
  - CWE-770
ingestedAt: '2026-10-21T12:48:53.658Z'
---

## Overview

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

## Affected packages

- `pydantic-ai-harness < 0.59.0`

## Remediation

Upgrade to a patched release:

- `pydantic-ai-harness 0.59.0`