EUVD-2026-30714
GHSA-9pj2-3x6v-c3pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconFork target repository
-
DeliveryCraft malicious branch name with shell metacharacters
-
ExploitSubmit pull request from poisoned branch
-
InstallGitHub Actions workflow triggers
-
C2Unsanitized branch name interpolated into shell command
-
ExecuteArbitrary code executes on CI runner
-
ImpactExfiltrate secrets or modify build artifacts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have authenticated GitHub access sufficient to create pull requests against repositories using vulnerable Vercel AI SDK versions-typically any GitHub user can fork public repositories and submit PRs. The target repository must use the |
| Impact | Despite the low CVSS 4.0 score of 1.3, this vulnerability represents a meaningful supply chain risk for organizations using Vercel AI SDK in development workflows. The low CVSS reflects several limiting factors: high attack complexity (AC:H) requiring the attacker to craft specific branch names that bypass any sanitization, low privileges (PR:L) requiring authenticated GitHub access to submit pull requests, and impacts limited to the CI/CD runner environment rather than production systems. However, successful exploitation grants arbitrary code execution in the CI environment, which commonly has access to secrets, deployment credentials, and source code. The public proof-of-concept (https://gist.github.com/YLChen-007/870bd6966cd84703d91ce54dfea3bdd0) confirms exploitability despite the 'difficult' rating, meaning skilled attackers or researchers can reliably trigger command injection. The vendor's non-responsiveness to disclosure is concerning for patch timeline. Real-world risk is moderate for organizations that accept external contributions via pull requests to repositories using affected Vercel AI SDK versions, as malicious contributors could exfiltrate CI secrets or inject backdoors into build artifacts. For closed-source projects with trusted committers only, risk is substantially lower. EPSS and CISA KEV data are not provided, suggesting no widespread exploitation campaigns detected yet. |
| Exploit ScenarioDerived | An external contributor forks the Vercel AI SDK repository on GitHub and creates a pull request with a maliciously crafted branch name such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 17, 2026
OS command injection in Vercel AI SDK versions up to 3.0.97 allows authenticated remote attackers with pull request creation privileges to execute arbitrary commands on CI/CD runners through malicious branch names. The vulnerability resides in the prettier-on-automerge GitHub Actions workflow, which insecurely interpolates PR branch names into shell commands. A public proof-of-concept exploit exists (disclosed via GitHub Gist), demonstrating feasibility despite CVSS 4.0 rating the complexity as high (AC:H) and exploitability as difficult. The vendor (Vercel) was notified but has not responded, and no patch availability is confirmed from vendor sources at time of analysis.
RemediationAI
No vendor-released patch version has been confirmed at time of analysis-Vercel was contacted during responsible disclosure but did not respond per VulDB submission 811402. Organizations should immediately implement compensating controls: First, audit all GitHub Actions workflows in the Vercel AI SDK repository for instances of unsanitized branch name or pull request title interpolation (search for github.head_ref, github.event.pull_request.head.ref, or similar context variables used in run: blocks without proper quoting). Second, modify the .github/workflows/prettier-on-automerge.yml workflow to sanitize inputs-replace direct interpolation with validated environment variables or use GitHub Actions expressions that automatically escape shell metacharacters. Third, restrict pull request workflow triggers to trusted branches only using pull_request_target with explicit paths and branches filters, and avoid checking out untrusted code in workflows with write permissions. Fourth, apply principle of least privilege to GitHub Actions workflows by using separate tokens with minimal scopes and avoiding storage of production credentials in CI secrets accessible to PR workflows. Note that disabling the prettier-on-automerge workflow entirely eliminates this attack surface but removes automated code formatting functionality. Monitor the upstream Vercel AI SDK repository (https://github.com/vercel/ai) for security advisories and patch releases beyond version 3.0.97. VulDB reference: https://vuldb.com/vuln/364392/cti
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Vercel AI SDK's GitHub Actions CI/CD workflow configuration. The file .github/workflows/prettier-on-automerge.yml contains a run step that performs unsanitized string interpolation of GitHub pull request branch names into shell commands. CWE-78 (OS Command Injection) occurs when user-controlled data-in this case, the branch name chosen by a contributor-is passed directly to a shell interpreter without proper escaping or validation. GitHub Actions contexts like github.head_ref or github.event.pull_request.head.ref are treated as trusted inputs by many workflow authors, but these values are attacker-controllable when a user creates a pull request from a fork with a specially-crafted branch name. The CPE identifier cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:* confirms the affected product is the Vercel AI library/SDK itself, not a SaaS platform component. The CVSS 4.0 vector indicates network-based attack (AV:N), high complexity (AC:H), low privileges required (PR:L), and proof-of-concept exploit availability (E:P), with low confidentiality, integrity, and availability impacts (VC:L/VI:L/VA:L) scoped to the vulnerable component only (SC:N/SI:N/SA:N).
Know when Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
discourse-ai is the AI plugin for the open-source discussion platform Discourse. Rated high severity (CVSS 7.2), this vu
Server-side request forgery in Vercel AI SDK versions up to 3.0.97 allows remote unauthenticated attackers to forge requ
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. Rated low severity (
Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote attackers t
Exploit-DB