Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading f

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Vercel AI SDK

  • 5.0.51 to ≤ 5.0.51affected
  • 6.0.0-beta.* to < 6.0.0-beta.*unaffected
  • 5.1.0-beta.8 to ≤ 5.1.0-beta.8affected
  • 5.1.0-beta.9 to < 5.1.0-beta.9unaffected
  • 5.0.52 to < 5.0.52unaffected

References