CVE-2025-48985CWE-20

CVE-2025-48985

Low · published November 7, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-11-07T06:15Z
Affected products (10)
ProductVersionsFixed in
vercel/ai< 5.0.525.0.52
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
vercel/aiall versions—
References (2)
https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed · [email protected]https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk · [email protected]
EPSS history
Timeline
  • 07 NOV 00:43Z
    A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta
    cvelistv5