Riskcovery

CVE-2026-8768

vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

State
Published
Severity
6.9 Medium
Published
May 17, 2026
Updated
May 18, 2026
Reserved
May 17, 2026

Read the record on cve.org

Description

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
3.07.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
2.07.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:URVulDB

Weaknesses

  • CWE-918 Server-Side Request Forgery

Affected Products

ProductVersions
aivercel
  • 3.0.0Affected
  • 3.0.1Affected
  • 3.0.2Affected
  • 3.0.3Affected
  • 3.0.4Affected
  • 3.0.5Affected
  • 3.0.6Affected
  • 3.0.7Affected
  • 3.0.8Affected
  • 3.0.9Affected
  • 3.0.10Affected
  • 3.0.11Affected
  • 3.0.12Affected
  • 3.0.13Affected
  • 3.0.14Affected
  • 3.0.15Affected
  • 3.0.16Affected
  • 3.0.17Affected
  • 3.0.18Affected
  • 3.0.19Affected
  • 3.0.20Affected
  • 3.0.21Affected
  • 3.0.22Affected
  • 3.0.23Affected
  • 3.0.24Affected
  • and 73 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.