Cloudanix VulnDB

CVE-2025-48985

Low · 3.7

CVSS

3.7

EPSS

0.3%

Published

Nov 7, 2025

CISA due date

—

The record

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

Affected packages

Ecosystem Package Introduced Fixed
npm ai 0 5.0.52
npm ai 5.1.0-beta.0 5.1.0-beta.9
Chainguard kibana-8.19 0 8.19.9-r0
Chainguard kibana-8.19-bitnami 0 8.19.9-r0
Chainguard kibana-8.19-iamguarded 0 8.19.9-r0
Chainguard kibana-9.1 0 9.1.9-r0
Chainguard kibana-9.1-iamguarded 0 9.1.9-r0
Chainguard kibana-9.2 0 9.2.3-r0
Chainguard kibana-9.2-iamguarded 0 9.2.3-r0
Chainguard langfuse 0 3.132.0-r0
Chainguard langfuse-compat 0 3.131.0-r0
Wolfi langfuse 0 3.132.0-r0
Wolfi langfuse-compat 0 3.131.0-r0

Related vulnerabilities