Description (CNA)
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Vercel / AI SDK | affected 5.0.51 through 5.0.51; unaffected 6.0.0-beta.* before 6.0.0-beta.*; affected 5.1.0-beta.8 through 5.1.0-beta.8; unaffected 5.1.0-beta.9 before 5.1.0-beta.9; unaffected 5.0.52 before 5.0.52 |
CWE
No CWE identifiers supplied.
References
- https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed
- https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk
ADP enrichment
No English description supplied.
No references supplied.