Input Validation Bypass in Vercel AI SDK

CVE-2025-48985

What is CVE-2025-48985?

A vulnerability exists in Vercel’s AI SDK that may enable attackers to bypass filetype whitelists during file uploads. This flaw could potentially allow unauthorized file uploads, leading to security risks for affected systems. Users are strongly advised to upgrade to the newly released versions 5.0.52, 5.1.0-beta.9, or 6.0.0-beta to mitigate this threat and secure their applications. For comprehensive information about this issue, please refer to the Vercel changelog.

References