Vercel Ai
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Vercel Ai.
By the Year
In 2026 there have been 3 vulnerabilities in Vercel Ai with an average score of 5.5 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3 | 5.53 |
It may take a day or so for new Ai vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Vercel Ai Security Vulnerabilities
Vercel AI 3.0.97 Resource Exhaust via createJsonResponseHandler
CVE-2026-8769
4.3 - Medium
- May 17, 2026
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Resource Exhaustion
SSRF in Vercel AI provider-utils validateDownloadUrl <3.0.97
CVE-2026-8768
7.3 - High
- May 17, 2026
A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
SSRF
Vercel AI 3.0.97 OS CMD Injection in PR Branch Name Interpolation
CVE-2026-8767
5 - Medium
- May 17, 2026
A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Shell injection
