CVE-2026-73424

The Astro Vercel adapter (10.0.3–11.0.2) in entrypoint.ts trusts the x_astro_path header for the /_isr function based only on x-vercel-isr, letting unauthenticated GET requests render routes protected only by Vercel edge path rules or split edge middleware. CVSS 6.5 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:...

CVE-2026-73424

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

EUVD-2026-50562

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials...

AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Security flaws in agent infrastructure from Amazon Web Services AWS, Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters,...

MAL-2026-12510 Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

Malicious code in table-ui-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0b953969edf8d77d5a1be0aa33b4044b38e2352f81c54b0f343f21a1c52c13a [email protected] ships dist/config.js, exposed via the package.json ./config subpath export, which exports a module-level array named HASHES...

Malicious code in aegis-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66d1f02c3c943836d41a7ec92c150c5529880890a4cc502115412dddb0c519c The package's declared postinstall hook runs node src/test.js, which issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-54249 VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-54249

CVE-2026-54249 affects Pydantic AI (Python agent framework) when using a Pydantic AI UI adapter (e.g., Vercel AI adapter). Versions 1.65.0–1.105.0 and 2.0.0b1–2.0.0b5 allow an attacker to reference arbitrary files in the application’s model-provider or cloud-storage account via UploadedFile refer...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-54249 VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

PT-2026-63559

Name of the Vulnerable Software and Affected Versions Next.js versions 15.5.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured. Malicious content within...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +9 more potentially affected by CVE-2026-73424 via @astrojs/vercel (>=10.0.6, <=10.0.8)

@astrojs/vercel NPM version =10.0.6, =0.0.3, =0.2.0, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.3.0 - taskair 0.0.1 Source cves: CVE-2026-73424 Source advisory: SNYK:JS-ASTROJSVERCEL-18599401...

Missing Authorization

Overview @astrojs/vercel is a Deploy your site to Vercel Affected versions of this package are vulnerable to Missing Authorization via the isr process. An attacker can access protected content by sending unauthenticated GET requests with a crafted xastropath query parameter, causing the server to...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +9 more potentially affected by CVE-2026-73424 via @astrojs/vercel (>=10.0.6, <=10.0.8)

@astrojs/vercel NPM version =10.0.6, =0.0.3, =0.2.0, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.3.0 - taskair 0.0.1 Source cves: CVE-2026-73424 Source advisory: OSV:GHSA-X27W-589X-FRM2...

GHSA-X27W-589X-FRM2 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

MAL-2026-10736 Malicious code in memtry-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11638a6b1b7876a94ef23285cb88f0127c003bb5e4d786dbaba5c30a9cbdfdb7 memtry-cli installs an MCP server whose memtryonboarding tool returns a prompt that instructs the connected AI agent to scan the installer's home...