ZeroDay Findings
Sign inSign up

Findings

CVE-2026-8767

A vulnerability has been found in vercel ai up to 3.0.97.

Published May 17, 2026 · updated Oct 14, 2026 · vercel ai

A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Timeline

Detection, updates, and resolution for this record.

  1. May 17, 2026 · NIST NVD

    Detected

    A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to th

  2. Oct 14, 2026 · NIST NVD

    Updated

    A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to th

Affected

  • cpe vercel/aiversion unspecified

Sources

  • CVE.orgCVE-2026-8767

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-8767

    30-day exploitation probability 7.0%

    first.org
  • NIST NVDCVE-2026-8767

    A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The

    nvd.nist.gov

References