AI Manager CVE-2026-94545 assessment¶
Status: Current | Last reviewed: 2026-09-29
Use this assessment to respond to the Next.js RCE finding for
ai-manager.vanguard.dev.trueserve.deloitte.com. The advisory and vulnerable
dependency are real. The inspected AI Manager source does not implement the
image-generation path required for this CVE. Upgrade the dependency and record
that distinction instead of treating a version match as proof of exploitable RCE.
Vendor evidence¶
Vercel published
GHSA-vcvr-r3jv-pc5j
on 2026-09-22, identifying CVE-2026-94545, Critical severity and CVSS 4.0
score 9.5. Its affected npm next range is >=16.2.0, <16.3.6.
The 16.3.6 release
explicitly includes this security fix.
The vulnerable operation is the Node.js ImageResponse implementation from
next/og, receiving attacker-controlled values in SVG content, attributes or
styles. Vercel excludes the Edge implementation and applications that do not
pass attacker-controlled values into that operation. Merely serving Next.js,
ordinary SVG assets or an image upload endpoint does not establish that condition.
Vanguard evidence¶
The assessment starts from clean source commit
228948ae on environment/vanguard.
| Check | Before remediation |
|---|---|
| Listener on port 3001 | next-server (v16.2.9), PID 1021239 |
| Listener working directory | /workspaces/trueserve-framework/apps/ai-manager |
| Listener environment | PUBLIC_FQDN=vanguard.dev.trueserve.deloitte.com, NODE_ENV=development |
Installed next package and npm lock |
Both 16.2.9 |
| Source references | No next/og, @vercel/og, ImageResponse, satori, resvg or generateImageMetadata references in AI Manager |
| Metadata routes | No opengraph-image or twitter-image route files |
| Public HTTPS checks | /login and /api/health return 200; health confirms database connectivity |
| Unauthenticated access | /api/auth/session and /api/agents return 401; /agents redirects to login |
The process environment, working directory and checked-in nginx routing identify
this target as the Vanguard city service. It is separate from official Dev at
studio.dev.trueserve.deloitte.com. Refreshed origin/dev and origin/qa also
lock AI Manager to 16.2.9 and contain no references to the affected API, but those
branch checks do not establish the versions deployed in official environments.
Repeat the source check from the repository root:
git grep -n -i -E \
'next/og|@vercel/og|ImageResponse|satori|resvg|generateImageMetadata' \
HEAD -- apps/ai-manager ':!**/package-lock.json' ':!**/pnpm-lock.yaml'
git ls-files apps/ai-manager | grep -E '(^|/)(opengraph-image|twitter-image)\.'
Both searches return exit status 1 when there are no matches. Reassess reachability if a later change adds server-side image generation.
Remediation¶
AI Manager pins next and eslint-config-next to 16.3.6 in
package.json. Both
package-lock.json and
pnpm-lock.yaml include the patched
Next.js packages and their updated dependencies.
The npm lock is used by the Vanguard launcher and Docker build. A lockfile edit alone does not change a running process: install the patched dependencies, restart the affected Vanguard service, and verify the new listener version and public HTTPS behavior. Official Dev/QA and other hosts need their own normal promotion and deployment verification.
Validation uses an isolated checkout of the same source with the patched dependencies and no copied environment secrets:
| Check | Result |
|---|---|
| Clean npm install | npm ci succeeds |
| pnpm reproducibility | Frozen lockfile check succeeds with pnpm 11.1.3 |
| TypeScript | npm run typecheck passes |
| Production build | npm run build passes with Next.js 16.3.6 |
| Route authentication | All 445 route files pass npm run audit:routes |
| Unit suite | 1,321 pass, 2 fail, 5 skip; both failures reproduce with the original dependencies |
| Lint | 4 errors and 918 warnings; the same 4 errors reproduce with the original lint dependencies |
The existing test failures are catalog price coverage in
lib/costing/costing.test.ts and a source-text assertion in
lib/krisp-voice-translation.test.ts. Existing lint errors are render-time ref
access in PipelineYjsBridge.tsx and WorkflowYjsBridge.tsx. Those unrelated
checks remain open; they are not counted as passing or suppressed by this fix.
Verified running service¶
On 2026-09-26, the patched dependencies were installed in Vanguard and only
ai-manager was restarted. The port-3001 listener changed to PID 1311577,
reported next-server (v16.3.6), and retained the AI Manager working
directory. The installed package and npm lock both report 16.3.6; the
manifest and both lockfiles match the isolated, validated patch.
All five public HTTPS checks in the baseline table retain the same status and redirect behavior. A Chromium check reaches the rendered sign-in screen with no page exceptions or failed Next.js assets. The existing saved browser session returns 401, so authenticated editor behavior and a complete fresh SSO login were not verified.
Local evidence is retained under
.local-data/security-next-cve-2026-94545/: the vendor advisory/release responses,
before/after HTTP checks, browser result, dependency and validation logs, and
the original dependency manifests for rollback. This directory is Git-ignored;
the conclusions and check results above are the portable review record.
Disposition and scope¶
For the original Vanguard finding, distinguish these two conclusions:
- Dependency finding: valid. The installed 16.2.9 release is in Vercel's affected range and warrants upgrading.
- Application exploitability: required path absent in inspected source. The reported unauthenticated RCE is not demonstrated. Under the vendor's stated conditions, this AI Manager implementation is not affected by that exploit path. This is not an assessment of other CVEs or evidence that the host has never been compromised.
The Vanguard dependency finding can be recorded as remediated: Next.js 16.3.6 installed and running, with no affected image-generation path found in the inspected pre-remediation application source. Request a fresh scanner run against Vanguard to update the scanner's own result; this assessment does not claim that an external rescan has already passed.
Richmond was independently inspected and patched on 2026-09-26; see its assessment for the source revision, both hostnames and verified runtime. Gallery serves a Next.js-marked login response, but its installed version, source revision and image-generation routes remain unverified. Do not close Gallery's finding on the basis of the Vanguard or Richmond results.