Описание
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.
Пакеты
Наименование
ai
npm
Затронутые версииВерсия исправления
< 5.0.52
5.0.52
Наименование
ai
npm
Затронутые версииВерсия исправления
>= 5.1.0-beta.0, < 5.1.0-beta.9
5.1.0-beta.9
Связанные уязвимости
CVSS3: 3.7
nvd
3 месяца назад
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk