CVE-2026-44479

Katalog CVE

CVSS 5.5 · Medium EPSS 0,16%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada vercel. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those suggestions. The plaintext token may be captured in CI/CD logs, agent transcripts, or other automation output. This vulnerability is fixed in 52.0.1.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vercel/vercel/security/advisories/GHSA-pgf8-2hgj-grqg mitigasi · advisory vendor