GHSA-rwvc-j5jr-mgvhLowCVSS 3.7

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

Published
November 7, 2025
Last Modified
December 2, 2025

🔗 CVE IDs covered (1)

CVE-2025-48985 →

📋 Description

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

🎯 Affected products2

  • npm/ai:< 5.0.52
  • npm/ai:>= 5.1.0-beta.0, < 5.1.0-beta.9

🔗 References (5)