EUVD-2026-30713
GHSA-8rqj-9gxc-63cr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify target using Vercel AI SDK
-
DeliveryCraft malicious URL payload
-
ExploitSubmit to SDK endpoint
-
InstallvalidateDownloadUrl processes crafted URL
-
C2Server fetches internal resource
-
ExecuteExtract sensitive data from response
-
ImpactPivot to cloud infrastructure compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Vercel AI SDK up to version 3.0.97 when applications utilize provider-utils blob download functionality. Attack succeeds when applications accept user-controlled URLs passed to validateDownloadUrl function without implementing their own SSRF protections. Exploitation is particularly effective in cloud environments (AWS, Azure, GCP) where default network configurations permit server egress to metadata endpoints and where IMDSv1 or equivalent unprotected metadata services are enabled. Applications restricted to downloading from hardcoded or strictly validated URL allowlists are not vulnerable, but this requires custom implementation beyond default SDK behavior. |
| Impact | CVSS 4.0 vector indicates network-accessible attack requiring no authentication, low complexity, and no user interaction (AV:N/AC:L/PR:N/UI:N), with low confidentiality, integrity, and availability impacts (VC:L/VI:L/VA:L). The E:P modifier confirms proof-of-concept exploit exists and is publicly available via GitHub gists. However, scope is unchanged (SC:N/SI:N/SA:N), limiting impact to the vulnerable component itself. Real-world risk is moderate-to-high for internet-facing deployments: SSRF can enable internal network reconnaissance, cloud metadata service access (AWS IMDSv1, Azure metadata endpoints), and potential pivot to more severe attacks. The 5.5 CVSS score underrepresents risk in cloud environments where SSRF commonly chains with credential theft. Vendor non-responsiveness significantly elevates risk as no official patch timeline exists and users lack authoritative guidance. Without EPSS data or KEV listing, widespread exploitation is not confirmed, but public POC lowers the exploitation barrier. Priority depends on deployment context: critical if SDK runs in cloud environments with sensitive internal resources, moderate if deployed in isolated networks with strict egress filtering. |
| Exploit ScenarioDerived | An attacker identifies a publicly accessible application using Vercel AI SDK 3.0.97 for AI model integration. They craft a malicious API request containing a URL parameter processed by the vulnerable validateDownloadUrl function, substituting a legitimate model URL with http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata endpoint). The server, lacking proper URL validation, fetches this internal resource and returns temporary AWS credentials in the response or error message. With cloud credentials obtained, the attacker escalates to compromise S3 buckets, EC2 instances, or other AWS resources. Public POC code from the referenced gists provides ready-made exploitation techniques, lowering the skill barrier for opportunistic attackers scanning for Vercel AI SDK deployments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 17, 2026
Server-side request forgery in Vercel AI SDK versions up to 3.0.97 allows remote unauthenticated attackers to forge requests from the server to arbitrary internal or external resources via the validateDownloadUrl function in provider-utils. Publicly available exploit code exists (CVSS E:P). EPSS data not available, not listed in CISA KEV. Vendor unresponsive to disclosure, indicating no official patch or advisory at time of analysis. Organizations using affected versions for AI model downloads or blob handling should implement immediate compensating controls.
RemediationAI
No vendor-released patch identified at time of analysis - Vercel did not respond to coordinated disclosure. Immediate compensating controls required: First, implement strict URL allowlisting at the application layer before calls to validateDownloadUrl, permitting only trusted AI model hosting domains (e.g., specific AWS S3 buckets, Hugging Face CDN endpoints). Trade-off: breaks workflows requiring dynamic model sources. Second, deploy egress filtering at network layer to block server access to RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254). Trade-off: may disrupt legitimate internal API calls. Third, if using cloud infrastructure, enforce IMDSv2 (AWS) or equivalent metadata protections (Azure, GCP) to mitigate credential theft via SSRF. Consider temporarily replacing provider-utils blob download functionality with custom implementation using battle-tested HTTP client libraries with SSRF protections (e.g., axios with strict redirects disabled and IP validation). Monitor Vercel's GitHub repository (vercel/ai) for community-driven patches or forks. Reference technical analysis at https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71 for exploitation vectors to inform defensive measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the provider-utils package component of the Vercel AI SDK, specifically within the validateDownloadUrl function in packages/provider-utils/src/download-blob.ts. This function likely handles validation and fetching of AI model files or other blob resources from URLs. CWE-918 (Server-Side Request Forgery) indicates insufficient validation of user-supplied URLs before the server makes HTTP requests, enabling attackers to manipulate the server into accessing unintended destinations. SSRF vulnerabilities in AI SDK contexts are particularly concerning because model download functionality often requires fetching large files from remote sources, creating a broad attack surface. The provider-utils component suggests this affects multiple AI provider integrations within the SDK ecosystem.
Know when Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
discourse-ai is the AI plugin for the open-source discussion platform Discourse. Rated high severity (CVSS 7.2), this vu
OS command injection in Vercel AI SDK versions up to 3.0.97 allows authenticated remote attackers with pull request crea
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. Rated low severity (
Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote attackers t
Exploit-DB