0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +12141 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.36)

@ai-sdk/provider-utils NPM version =0.0.0, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.64 and more Source cves: CVE-2026-8769 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16735288...

0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +12141 more potentially affected by CVE-2026-8768 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.36)

@ai-sdk/provider-utils NPM version =0.0.0, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.64 and more Source cves: CVE-2026-8768 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16734888...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1608 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0, =22.0.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.1.1, =0.0.4, =0.0.1, =0.3.0, =0.0.1, =0.0.4, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @activepieces/piece-activecampaign (>=0.1.4, <=0.1.5) +2048 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0, =0.2.0, =0.1.4, =0.4.1, =0.1.1, =0.1.1, =0.0.1, =0.0.7, =0.1.1, =0.1.1, =0.0.1, =0.1.1, =0.1.1, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

@agentproto/adapter-mastracode-inprocess (>=0.2.0, <=0.2.6), @ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0) +206 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (5.0.0-canary.48)

@ai-sdk/provider-utils NPM version 5.0.0-canary.48 is affected by a known vulnerability. The following packages have a transitive dependency on @ai-sdk/provider-utils and may be impacted: - @agentproto/adapter-mastracode-inprocess =0.2.0, =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0,...

EUVD-2026-30712

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

GHSA-866G-F22W-33X8 @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8769

CVE-2026-8769 affects vercel ai up to 3.0.97, specifically the provider-utils file response-handler.ts (functions createJsonResponseHandler and createJsonErrorResponseHandler). The issue enables resource consumption that can be triggered remotely; exploit publicly disclosed. Details on affected v...

CVE-2026-8769 vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8768

CVE-2026-8768 affects vercel ai up to 3.0.97, specifically the provider-utils component and its function validateDownloadUrl in packages/provider-utils/src/download-blob.ts. The vulnerability enables server-side request forgery (SSRF) and can be triggered remotely. The exploit has been made publi...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

Malicious Package

Overview color-style-utils is a malicious package. This package contains malicious code that includes infostealer malware, one of which is a Shai-Hulud clone following the TeamPCP open source release, and one DDoS botnet package. While this package might be attempting to impersonate a valid...

Malicious Package

Overview axois-utils is a malicious package. This package contains malicious code that includes infostealer malware, one of which is a Shai-Hulud clone following the TeamPCP open source release, and one DDoS botnet package. While this package might be attempting to impersonate a valid organizatio...

CVE-2026-8735 Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization

A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly availab...

CVE-2026-8769: Uncontrolled Resource Consumption

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8768: Server-Side Request Forgery (SSRF)

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

PT-2026-41588

Name of the Vulnerable Software and Affected Versions vercel ai versions prior to 3.0.98 Description A resource consumption issue exists in the provider-utils component. The flaw is located within the createJsonResponseHandler and createJsonErrorResponseHandler functions in the...

Vercel AI SDK 代码问题漏洞

Vercel AI SDK is a JavaScript SDK developed by Vercel that supports the integration of large language models, streaming responses, and AI application development. Versions of Vercel AI 3.0.97 and earlier contain code vulnerabilities. These vulnerabilities stem from the validateDownloadUrl functio...

MAL-2026-3803 Malicious code in venv-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9af11c23295a9a592b6fd62d62490669a752ab6dc6c0b755ebd068ec6371375f Package contains code to silently execute a RAT-like agent, allowing the attacker to access the file system and execute arbitrary code. --- Category: MALICIOUS...