CVE-2025-48985
1 advisory.
npm/ai CVE-2025-48985: low 3.7
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
Action: Upgrade ai to 5.0.52 or later.
npm i ai@5.0.52npm i ai@5.1.0-beta.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.52 | - |
| 5.1.0-beta.0 | 5.1.0-beta.9 | - |
Fixed versions
| 5.0.52 | 5.1.0-beta.9 |
Sources
- osv: GHSA-rwvc-j5jr-mgvh
- https://nvd.nist.gov/vuln/detail/CVE-2025-48985
- https://github.com/vercel/ai/issues/8881
- https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed
- https://github.com/vercel/ai
- https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk
CVE-2025-48985 · published · modified · JSON