Vercel CLI CVE-2026-44479

All three of the following must be simultaneously true: (1) Token passed as --token or -t CLI argument (not via VERCEL_TOKEN environment variable); (2) CLI runs in non-interactive mode (explicit --non-interactive flag or automatic AI agent detection); (3) The command cannot complete autonomously, triggering emission of a JSON suggestion payload (missing --yes flag, ambiguous project scope, API errors, or other incomplete state). Successful commands that complete without user input do not produce suggestion output and do not leak tokens. The vulnerability does NOT affect deployments using VERCEL_TOKEN environment variable, explicit --yes flag confirmations in non-interactive mode, or interactive (tty-attached) CLI usage. Exploitation requires only read access to system logs, CI/CD artifacts, or process output - no authentication or elevated privileges beyond standard user access.

CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates local attack vector with user interaction required, confidentiality impact only. However, real-world risk is significantly elevated beyond the CVSS score because: (1) the user interaction is passive (running a CLI command) in automated contexts; (2) CI/CD logs capturing this output are often widely accessible to development teams; (3) affected versions span a 6-month window (50.16.0 to 52.0.0), suggesting potential widespread exposure; (4) the condition is not exotic - developers legitimately use --token in automation to avoid interactive prompts. The local attack vector is misleading in CI/CD contexts where log artifacts are accessible to multiple team members and retention services. No KEV status or POC provided; exploitation is straightforward log review requiring no special tooling. EPSS data not provided. This is a real priority despite moderate CVSS due to ease of token capture in high-visibility automation logs and likelihood that exposed tokens enable full Vercel account compromise.

A developer uses Vercel CLI with --token flag in a GitHub Actions or GitLab CI pipeline to deploy a project without interactive prompts. The deployment encounters an ambiguous scope or missing --yes flag, causing the command to fail and emit a JSON suggestion payload to stdout. The CI/CD system captures this output in publicly or team-accessible logs. An attacker with read access to CI/CD logs (teammate, contractor, or via log service breach) extracts the plaintext token and uses it to access the developer's Vercel account, projects, and deployment history.