#vercel
-
A fake gig and a git hook: an attempt to steal developer credentials
REVSYS founder Frank Wiles describes how a supposed client tried to run arbitrary code on his laptop through an innocent-looking git repository.
-
Critical Next.js flaw: server code execution via a crafted SVG
ImageResponse, the feature that generates social preview images, can under certain conditions let an attacker run code on the server. Vercel shipped a fix on September 22.
-
Next.js Patches Two Critical Remote Code Execution Vulnerabilities
Vercel has shipped out-of-band patches for Next.js: one flaw is exploited through a malicious AVIF file, the other through path traversal on Windows servers. Both allow code execution without authentication.
-
CoreBreak: AWS, Google and Vercel Agents Tricked Into Running Tools Without the Model
At Black Hat USA 2026, researchers from Stealth demonstrated a general class of attacks in which forged tool calls reach an AI agent's execution layer without the language model ever taking a turn. AWS, Google and Vercel have shipped fixes.