VDB
CVE-2025-48985
CVE-2025-48985
PUBLISHED
CVSS 3.700000047683716 LOW
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
EPSS 0.28% · 20.7th percentile
Risk Scores
CVSS 3.1
3.700000047683716
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score
0.28%
20.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vercel | ai | 5.1.0, 5.1.0, 0 |
| npm | ai | 5.1.0-beta.0, 0 |
| Vercel | AI SDK | 5.1.0-beta.9, 5.1.0-beta.8, 6.0.0-beta.* |
Timeline
- Nov 7, 2025 CVE Published
- Nov 7, 2025 EPSS Score
- Nov 7, 2025 PoC Published
- Nov 7, 2025 PoC Published
- Nov 7, 2025 PoC Published
- Nov 11, 2025 PoC Published
- Nov 13, 2025 EPSS Score
- Nov 19, 2025 EPSS Score
- Nov 25, 2025 EPSS Score
- Dec 1, 2025 EPSS Score
- Dec 2, 2025 CVE Updated
- Dec 7, 2025 EPSS Score
References
- https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed fix
- https://github.com/vercel/ai/issues/8881 discussion
- https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk url
- https://nvd.nist.gov/vuln/detail/CVE-2025-48985 advisory
- https://github.com/vercel/ai package