A vulnerability classified as critical has been found in vercel ai up to 3.0.97 . Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation . The manipulation leads to os command injection. This vulnerability is documented as CVE-2026-8767 . The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.