CVE-2026-8767

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
vercelai3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.0.10; 3.0.11; 3.0.12; 3.0.13; 3.0.14; 3.0.15; 3.0.16; 3.0.17; 3.0.18; 3.0.19

References

Timeline

Published
May 17, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-876704.3An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding resCVE-2026-876717.5An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated CVE-2026-876725.5An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.CVE-2026-876737.2An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d anCVE-2026-876747.8A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 througCVE-2026-876756.8An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.CVE-2026-876765.7A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsiCVE-2026-876776.6An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 throCVE-2026-876785.2An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. WhCVE-2026-876797.2When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings inCVE-2026-87687.3A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-CVE-2026-876808.8A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated u
CVE-2026-8767: High severity, CVSS 7.5 | Vulnix