CVE-2026-8767: vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection
A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8767?
CVE-2026-8767 has a significant severity due to the potential for remote command execution through OS command injection.
How do I fix CVE-2026-8767?
To fix CVE-2026-8767, update the vercel ai package to version 3.0.98 or later.
What versions are affected by CVE-2026-8767?
CVE-2026-8767 affects vercel ai versions up to and including 3.0.97.
What specific component is vulnerable in CVE-2026-8767?
The vulnerability in CVE-2026-8767 resides in the function run of the file .github/workflows/prettier-on-automerge.yml.
What type of vulnerability is CVE-2026-8767?
CVE-2026-8767 is an OS command injection vulnerability that allows manipulation through branch name interpolation.