CVE-2025-48985
Low
Description
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk
SeverityLow
CVSS3.7
Exploit probability—
Product
Vercel Ai
PublishedNov 7, 2025
First seenNov 7, 2025
Weakness typeCWE-20Improper input validation
How to fix
Update
- vercel ai5.0.52 or later
- ai5.0.52, 5.1.0-beta.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vercel ai | v < 5.0.52, 5.1.0 | 5.0.52 |
| ainpm | v < 5.0.52, 5.1.0-beta.0 ≤ v < 5.1.0-beta.9 | 5.0.52, 5.1.0-beta.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.