Vercel AI SDK

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 1 asset) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $500 │ $625 Submit a vulnerability CVE history 6 Last 12 months 6 Lifetime Code execution 30 % Access control 25 % Parsing/validation 25 % Injection 15 % Latest advisories Loading the feed Overview The AI SDK is the dominant TypeScript and JavaScript LLM toolkit: it is the default in the Next.js AI ecosystem, ships as the backbone of thousands of production chat and agent endpoints, and its MCP client is one of the most widely deployed MCP client implementations in JavaScript. Because it sits in the request path of server-rendered AI routes, an MCP allowlist bypass or a prototype-pollution bug lands directly on internet-facing infrastructure rather than on a developer workstation, and Vercel's own focus-area list confirms they treat the MCP client trust boundary as the primary attack surface. All six of its advisories landed in the last twelve months, so this is a surface being actively worked rather than a quiet one. Vercel pays it as a Tier 1 asset on its open-source program, from $500 for a low finding up to $10,000 for a critical, and sorona.xyz adds 1.25× on top of whatever Vercel awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 7 business days Triage 10 business days after triage Bounty In scope The vercel/ai repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, with the provider integration packages in the same monorepo carved out by name The core generation and streaming API: text and object generation, the streaming protocol, and the agent loop that runs between model calls Tool calling end to end, covering how tools are declared, which of them a model may call, how approval is enforced and what actually happens at execution time The MCP client: its transports, tool discovery and allowlist, plus the OAuth metadata discovery and URL validation that run before a connection is made Structured output handling: schema enforcement, parsing and repair of model output, and what reaches application code when validation does not hold File and attachment handling on the way into a model call, including the type checks the SDK applies to an upload The UI packages this repo publishes for React, Svelte and Vue, including the chat transport and the message stream a client parses Shared internals: the HTTP layer in the provider-utils package, the model middleware and registry, and everything else the core SDK uses to reach a model endpoint Out of scope Prompt injection reports where no tool access, sensitive data, or meaningful attacker-controlled action is at risk: the report must demonstrate what the attacker concretely achieves beyond influencing model output Issues in the provider packages such as the OpenAI, Anthropic, or Fireworks integrations, which are not the core SDK and belong to the relevant provider's security program even though they live in this same monorepo Security issues in example code or documentation snippets, which the policy places explicitly out of scope Tool approval bypasses that rely entirely on forged client-side message history Third-party dependency CVEs, archived repositories, end-of-life versions, and development-only denial of service Anything found by testing against production systems, barred by the policy amendment Vercel made in November 2025 Reports without the mandatory zip proof-of-concept artifact, which are not eligible regardless of severity Most-valued findings An MCP client allowlist bypass that exposes or executes a tool the operator never approved, the surface Vercel itself names first and the route to the $10,000 critical row Tool execution control bypass carried through to code execution or significant data access, rather than stopped at the point where the restriction was shown to be loose Prototype pollution in SDK internals chained onward into SSRF, authorization header theft, or privilege escalation on an internet-facing AI route MCP OAuth metadata handling flaws, including a file:// URI slipping past URL validation or SSRF during redirect-following in metadata discovery Structured-output validation bypass where unvalidated model output reaches application code with the declared schema unenforced File-type checks that can be walked around on the way into a model call, the shape of the SDK's one published advisory (CVE-2025-48985) Any of the above proven against the core SDK rather than one of the provider packages sharing the monorepo Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Include a zip proof-of-concept artifact with every report, without one the finding is not bounty-eligible Prompt injection pays only where tool access or data is demonstrably at risk: show what the attacker concretely achieves beyond influencing model output Do not test against production systems, a rule the policy was amended to add in November 2025 Confidentiality obligations last two years and survive the end of the program Program stats 100 Reports resolved $241k Bounties paid 89% Response efficiency Disclosure Coordinated through Vercel, under a confidentiality obligation that runs for two years and outlives the program, so publication waits on Vercel's written consent rather than a fixed clock. sorona.xyz holds your finding until Vercel has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability