Riskcovery

CVE-2025-48985

State
Published
Severity
3.7 Low
Published
Nov 7, 2025
Updated
Dec 1, 2025
Reserved
May 29, 2025

Read the record on cve.org

Description

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

Scores

CVSSScoreVectorSource
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nhackerone

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
AI SDKVercel
  • 5.0.51 through 5.0.51Affected
  • 6.0.0-beta.* to before 6.0.0-beta.*Not affected
  • 5.1.0-beta.8 through 5.1.0-beta.8Affected
  • 5.1.0-beta.9 to before 5.1.0-beta.9Not affected
  • 5.0.52 to before 5.0.52Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.