Richmond AI Manager CVE-2026-94545 assessment¶
Status: Current | Last reviewed: 2026-09-29
Use this assessment to respond to the Next.js RCE finding for
2fai-manager.richmond.trueserve.ai and the canonical
ai-manager.richmond.trueserve.ai. Richmond's starting Next.js version is
16.2.9, within the vendor's affected range. Its inspected AI Manager source
does not contain the image-generation operation required for this exploit.
Advisory and applicability¶
Vercel's
GHSA-vcvr-r3jv-pc5j
identifies CVE-2026-94545, Critical severity, and an affected npm next
range of >=16.2.0, <16.3.6. The
16.3.6 release
contains the fix. The advisory was checked again on 2026-09-26.
Exploitation requires attacker-controlled SVG content, attributes or styles
passed to the Node.js ImageResponse implementation from next/og.
Vercel excludes applications without that input path and the Edge
implementation. A version match establishes an affected dependency, not proof
that an application exposes unauthenticated RCE.
Target and source evidence¶
| Check | Before remediation |
|---|---|
| Target | EC2 i-088ae335f2b4162ac, us-east-1, tagged trueserve-dev-richmond |
| Running checkout | Branch richmond, commit c88adc3b57896793fe5db6e22a3b9a2da0452b7a |
| Runtime | Devcontainer 277e35e97b20, Node.js 22.23.2, npm 10.9.8 |
| Port 3001 | PID 2686412, next-server (v16.2.9) |
| Listener environment | PUBLIC_FQDN=richmond.trueserve.ai, NODE_ENV=development |
| Dependency evidence | Manifest requests ^16.2.9; npm lock and installed package both contain 16.2.9 |
| Source search | No next/og, @vercel/og, ImageResponse, satori, resvg or generateImageMetadata references |
| Metadata routes | No opengraph-image or twitter-image route files |
The host checkout at /home/ubuntu/trueserve-framework is mounted at
/workspaces/trueserve-framework inside the devcontainer. Its application
source is clean at the recorded revision. Existing local changes concern
access documentation and relay scripts; preserve those independently of this
dependency patch.
The live nginx configuration routes ai-manager.richmond.trueserve.ai to
127.0.0.1:3001. That first HTTPS vhost is also the implicit default, so the
scanner's 2fai-manager.richmond.trueserve.ai hostname reaches the same
application. Both names were checked with normal TLS verification.
For both names, the initial public checks return:
| Request without a session | Expected result |
|---|---|
/login |
200 |
/api/health |
200, database connected |
/api/auth/session |
401 JSON |
/api/agents |
401 JSON |
/agents |
307 to /login?redirect=%2Fagents |
Patch and validation¶
The patch pins next and eslint-config-next to 16.3.6 and regenerates
both npm and
pnpm lockfiles. It is prepared against
Richmond's exact recorded source revision in an isolated checkout. The three
starting dependency files match the remote files by SHA-256.
Validation uses an isolated checkout without copying Richmond's environment secrets:
| Check | Result |
|---|---|
| Clean dependency install | npm ci passes |
| pnpm lock reproducibility | Frozen lockfile check passes with pnpm 11.1.3 |
| TypeScript | npm run typecheck passes |
| Production build | npm run build passes with Next.js 16.3.6 |
| Unit tests | All 762 pass |
| Route authentication | All 410 route files pass |
| Lint | 4 errors and 715 warnings; the same 4 errors reproduce on Richmond's original dependencies |
The pre-existing lint errors concern render-time ref access in
PipelineYjsBridge.tsx and WorkflowYjsBridge.tsx. They remain open and are
not suppressed by this patch. The isolated check uses Node.js 22.15.0; live
verification uses Richmond's existing Node.js 22.23.2.
Source, dependency and runtime changes must be distinguished: an updated lockfile alone does not patch the running Node.js process.
Verified running service¶
At 2026-09-26 14:21 UTC, Richmond's port-3001 listener is PID 564383,
reporting next-server (v16.3.6). The installed package and both lockfiles
match the validated patch. Health returns 200 with the database connected.
Only AI Manager was restarted.
All ten public HTTPS checks retain their pre-upgrade status and redirect behavior across the canonical and scanner-reported hostnames. A Chromium check follows each hostname's login flow to the Microsoft sign-in screen with no page exceptions or failed Next.js assets. A complete fresh SSO login and authenticated editor interaction were not tested.
The live branch remains richmond at the same base commit, with this patch
uncommitted. SHA-256 checks confirm all 34 pre-existing modified or
untracked files retain their contents, and the staged diff is unchanged.
The upgrade does not replace Richmond's application source with Vanguard's
newer revision.
Richmond retains the original affected files, preserved local work, staged
diff and applied patch at
/home/ubuntu/trueserve-security-backups/next-cve-2026-94545/.
Its install and runtime evidence is under the checkout's Git-ignored
.local-data/security-next-cve-2026-94545/. The investigating workspace
retains the full SSM, build, test and public HTTP/browser evidence under
.local-data/security-next-cve-2026-94545/richmond/.
Disposition¶
The dependency finding is valid. The inspected pre-remediation application does not use the API required by the vendor's exploit conditions. No exploit payload was sent, and this assessment does not determine whether the host has ever been compromised or whether other CVEs apply.
Record the dependency finding as remediated: Next.js 16.3.6 installed and
running on Richmond, with no affected next/og input path found in the
inspected pre-remediation source. Request a fresh scanner run for both
hostnames. An external scanner rescan is separate from these source and
runtime checks and has not been performed here.