Vercel AI’s validateDownloadUrl function in provider‑utils allows an unauthenticated remote attacker to supply an arbitrary URL, causing the server to issue an HTTP request to that target. This server‑side request forgery (SSRF) can lead to disclosure of internal resources, disallowed access to internal networks, or facilitation of broader reconnaissance or lateral movement. The weakness is identified as CWE‑918 and carries a CVSS score of 6.9, indicating moderate severity.

Affected vendor is Vercel, product Vercel AI, versions up to 3.0.97 are vulnerable. The issue resides in the packages/provider‑utils/src/download‑blob.ts file of the provider‑utils component. No other product or version information is provided.

The CVSS score of 6.9 reflects moderate impact, and an EPSS score is unavailable, implying limited publicly available data on exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation yet, but publicly disclosed exploits exist. Because the attack vector is remote and requires no special user privileges, the risk to any deployed instance of Vercel AI that has not applied a patch is significant, particularly if the application allows outbound traffic to arbitrary destinations.