{"id":"EUVD-2025-38188","enisaUuid":"af6659db-1915-3c4d-bb10-f39039d368b4","description":"A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk","datePublished":"Nov 7, 2025, 12:43:28 AM","dateUpdated":"Dec 1, 2025, 8:12:57 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed\nhttps://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk\n","aliases":"CVE-2025-48985\nGHSA-rwvc-j5jr-mgvh\n","assigner":"hackerone","epss":0.28,"enisaIdProduct":[{"id":"145da69e-d637-3b66-9d13-bf74ba50abc9","product":{"name":"AI SDK","vendor":{"name":"vercel"}},"product_version":"5.1.0-beta.8 ≤5.1.0-beta.8"},{"id":"3a1722af-6c31-3477-884f-6a79f8bba039","product":{"name":"AI SDK","vendor":{"name":"vercel"}},"product_version":"5.0.51 ≤5.0.51"}],"enisaIdVendor":[{"id":"1eae800d-d203-3e92-afa3-82b2ef417a4e","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"201287f4-ed5a-3aa8-92e4-3a2602765bb7","vulnerability":{"id":"CVE-2025-48985","description":"A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk","datePublished":"Nov 7, 2025, 12:43:28 AM","dateUpdated":"Dec 1, 2025, 8:12:57 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed\nhttps://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk\n","enisa_id":"EUVD-2025-38188\n","assigner":"hackerone","epss":0.28,"dataProcessed":"Nov 4, 2026, 7:15:08 AM","vulnerabilityProduct":[{"id":"15f4e7fe-68c7-3055-a8bd-30688bcfc974","product":{"name":"AI SDK","vendor":{"name":"vercel"}},"product_version":"5.1.0-beta.8 ≤5.1.0-beta.8"},{"id":"67b7ff39-4ffd-354f-90c2-46ec37ee05ef","product":{"name":"AI SDK","vendor":{"name":"vercel"}},"product_version":"5.0.51 ≤5.0.51"}],"vulnerabilityVendor":[{"id":"c7297a6b-f488-36af-8900-7c9284c8a040","vendor":{"name":"vercel"}}]}},{"id":"337641b8-b9c8-3f5d-a32d-42dceceec7e6","vulnerability":{"id":"GHSA-rwvc-j5jr-mgvh","description":"Vercel’s AI SDK\u0027s filetype whitelists can be bypassed when uploading files","datePublished":"Nov 7, 2025, 3:30:25 AM","dateUpdated":"Dec 2, 2025, 1:27:15 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-48985\nhttps://github.com/vercel/ai/issues/8881\nhttps://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed\nhttps://github.com/vercel/ai\nhttps://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk\n","enisa_id":"EUVD-2025-38188\n","aliases":"GHSA-rwvc-j5jr-mgvh\nCVE-2025-48985\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}