CVE-2026-44479: Vercel: Non-interactive mode includes CLI arguments in suggested command output

May 7, 2026 (updated May 14, 2026)

When the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those suggestions.

References

github.com/advisories/GHSA-pgf8-2hgj-grqg
github.com/vercel/vercel/security/advisories/GHSA-pgf8-2hgj-grqg
nvd.nist.gov/vuln/detail/CVE-2026-44479

Code Behaviors & Features

Detect and mitigate CVE-2026-44479 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →