This vulnerability affects the validateDownloadUrl function in the file packages/provider-utils/src/download-blob.ts of vercel ai up to version 3.0.97. It allows an attacker to perform server-side request forgery by manipulating the function's input, potentially causing the server to make unintended requests. The vulnerability can be exploited remotely without authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, and availability. The vendor has not issued a patch or official fix, and no remediation level is specified.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server, potentially accessing internal resources or services not otherwise exposed. The impact is rated medium based on the CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing network-level controls to restrict outbound requests from the affected service to trusted destinations only, if feasible.