{"id":"EUVD-2025-38188","revision":"ea434213a6cd48a89e5f0b20bdff73ac","records":[{"revision":"ea434213a6cd48a89e5f0b20bdff73ac","observedAt":"2026-11-11T03:30:11.241+00:00","statement":{"source":"euvd","id":"EUVD-2025-38188","aliases":["CVE-2025-48985","GHSA-rwvc-j5jr-mgvh"],"title":"A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.","description":"A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":null}],"references":["https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed","https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-38188","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 7, 2025, 12:43:28 AM","dateUpdated":"Dec 1, 2025, 8:12:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-38188","identifiers":["EUVD-2025-38188","CVE-2025-48985","GHSA-rwvc-j5jr-mgvh"]},"retained":false,"historicalAffected":[]}],"coverage":[]}