Executive brief
A security vulnerability exists in the Vercel AI SDK's automated workflow for code formatting. By submitting a pull request with a specially crafted branch name, an attacker can execute unauthorized commands within the development environment. This could lead to the theft of sensitive deployment credentials, modification of source code, or interference with the software release process.
Technical details
An OS command injection vulnerability exists in the Vercel AI SDK GitHub Actions workflow file `.github/workflows/prettier-on-automerge.yml`. The vulnerability is caused by the direct interpolation of the attacker-controlled branch name (`github.event.pull_request.head.ref`) into a bash script using GitHub Actions' `${{ }}` expression syntax. Although Git branch names have character restrictions, attackers can use subshell execution sequences like `$()` and the Internal Field Separator (`$IFS`) to bypass these limits. An attacker with the ability to submit a pull request can execute arbitrary code in the context of the GitHub Actions runner, potentially accessing secrets like `GH_TOKEN` or deployment keys. The recommended fix is to use intermediate environment variables instead of direct string interpolation.
Affected products
- Vercel AI SDK up to 3.0.97
Timeline
- 2026-04-04: disclosed: Initial discovery and researcher disclosure via Gist
- 2026-05-17: advisory: CVE published to NVD