GitHub Advisoryadvisory · npm

GHSA-rwvc-j5jr-mgvh Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

LOW Published 2025-11-07 Modified 2025-12-02 Official page ↗
Aliases
CVE-2025-48985
Ecosystem
npm
Packages
ai
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20, CWE-682
Reviewed
2025-11-07

Affected packages

• npm ai: < 5.0.52 → fixed in 5.0.52 • npm ai: >= 5.1.0-beta.0, < 5.1.0-beta.9 → fixed in 5.1.0-beta.9

Description

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

Related

Alias · CVE (1)

  • CVE-2025-48985 A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-682 Incorrect Calculation weakness

References