CodeVetter · Repo Unpack · Risk map
pydantic/pydantic
These are source-observed trust boundaries and maintenance hazards, not confirmed vulnerabilities. Validation can intentionally execute application callbacks, resolve annotations, import modules, and load installed plugins. Legacy parsing and filesystem types expose explicit file/input boundaries beyond ordinary in-memory validation. Cross-language schema contracts, cached validators, and output policy have broad effects across public APIs.
- create_model explicitly warns that resolving string annotations may execute arbitrary code; annotation evaluation delegates to version-dependent typing._eval_type using supplied namespaces.
- ImportString routes string values to import_module and optional getattr, including a dotted-path fallback; this field type crosses into module execution rather than merely checking text.
- Plugin discovery loads installed entry points automatically unless disabled; callbacks receive inputs/results/errors, and callback exceptions are not isolated from callers by build_wrapper.
- Deprecated load_file reads the caller-supplied path directly, and load_str_bytes invokes pickle.loads only when pickle is selected and allow_pickle=True; the default rejects pickle decoding.
- PathType validators inspect arbitrary supplied paths using is_file/is_dir/is_socket/exists; they neither constrain paths to a repository root nor reserve a new path after checking it.
- model_construct bypasses validation, including extra='forbid' errors, and model_copy(update=...) applies unvalidated updates; treating either as a fresh input-validation boundary would violate its documented contract.
- Secret wrappers retain recoverable plaintext through get_secret_value and mask JSON output; error input hiding defaults to False, and ordinary validation-error tests include rejected input values.
- Schema compatibility and cache reuse are maintenance hotspots: import checks an exact core version, while forced model rebuilds use a global lock, replace compiled objects with mocks, and disable prebuilt reuse to avoid stale references.