I'm assuming Vercel would immediately install patches for anything on their end, but I run a website on Vercel for somebody else, and I can't find any announcements form Vercel, so I'm just doing my due diligence to make sure I provide the best service I can.
Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.
Please submit your report here: vercel.com/abuse
Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.