CVE-2026-8768

Published: Mag 18, 2026 Last Modified: Mag 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
HIGH 7,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: partial
Integrity: partial
Availability: partial

Description

AI Translation Available

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0005
Percentile
0,1th
Updated

EPSS Score Trend (Last 3 Days)

918

Server-Side Request Forgery (SSRF)

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, AI/ML, Web Server
View CWE Details
Application

Ai by Vercel

Product Information
Vendor Vercel
Product Ai
Version Range Affected
To 3.0.97 (inclusive)
cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://gist.github.com/YLChen-007/07d149bd68adbee58165b420…
https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71
https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a6…
https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a66d1d847f
https://vuldb.com/submit/811404
https://vuldb.com/submit/811404
https://vuldb.com/submit/811405
https://vuldb.com/submit/811405
https://vuldb.com/vuln/364393
https://vuldb.com/vuln/364393
https://vuldb.com/vuln/364393/cti
https://vuldb.com/vuln/364393/cti