{"action":"Upgrade ai to 5.0.52 or later.","affected":[{"fixed":"5.0.52","introduced":"0"},{"fixed":"5.1.0-beta.9","introduced":"5.1.0-beta.0"}],"component":"ai","cve_ids":["CVE-2025-48985"],"ecosystem":"npm","epss":0.00284,"exploited":false,"fixed_versions":["5.0.52","5.1.0-beta.9"],"ghsa_id":"GHSA-rwvc-j5jr-mgvh","id":"tcs_01M5KGA5D53PYPWR71MG2YZGXS","modified_at":"2026-09-10T03:50:58.597326499Z","published_at":"2025-11-07T03:30:25Z","references":["https://osv.dev/vulnerability/GHSA-rwvc-j5jr-mgvh","https://nvd.nist.gov/vuln/detail/CVE-2025-48985","https://github.com/vercel/ai/issues/8881","https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed","https://github.com/vercel/ai","https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-rwvc-j5jr-mgvh","url":"https://osv.dev/vulnerability/GHSA-rwvc-j5jr-mgvh"}],"summary":"Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files"}