CVE-2026-8767
MediumCVSS 5.0Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
A vulnerability has been found in vercel ai up to version 3.0.97, affecting the run function in the file .github/workflows/prettier-on-automerge.yml related to PR Branch Name Interpolation. The manipulation leads to OS command injection. The attack can be initiated remotely, though its complexity is rather high and exploitability is considered difficult.
Risk Assessment
The vulnerability may allow remote command execution in the CI/CD environment, risking compromise of the build process or data leakage. Despite the high attack complexity, the public disclosure of the exploit increases the risk.
Recommendation
Update vercel ai to a version newer than 3.0.97 if available, and review and secure GitHub Actions workflow files against interpolation of untrusted input.
Other vulnerabilities in vercel ai
Original NVD description (English source)
A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS