Vercel Ai vulnerabilities

CVE-2026-8767 [HIGH] CWE-77 CVE-2026-8767: A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file . A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered dif

CVE-2026-8768 [HIGH] CWE-918 CVE-2026-8768: A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDo A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendo

CVE-2026-8769 [MEDIUM] CWE-400 CVE-2026-8769: A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function creat A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been pu

CVE-2025-48985 [MEDIUM] CWE-20 CVE-2025-48985: A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk