GHSA-rwvc-j5jr-mgvh
Low · 3.7CVSS
3.7
EPSS
—
Published
Nov 7, 2025
CISA due date
—
The record
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | ai | 0 | 5.0.52 |
| npm | ai | 5.1.0-beta.0 | 5.1.0-beta.9 |
| Chainguard | kibana-8.19 | 0 | 8.19.9-r0 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.9-r0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.9-r0 |
| Chainguard | kibana-9.1 | 0 | 9.1.9-r0 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.9-r0 |
| Chainguard | kibana-9.2 | 0 | 9.2.3-r0 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.3-r0 |
| Chainguard | langfuse | 0 | 3.132.0-r0 |
| Chainguard | langfuse-compat | 0 | 3.131.0-r0 |
| Wolfi | langfuse | 0 | 3.132.0-r0 |
| Wolfi | langfuse-compat | 0 | 3.131.0-r0 |
Related vulnerabilities
- CVE-2025-48985 A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and… Same vulnerability
- GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__… Also affects kibana-8.19
- GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup Also affects kibana-8.19
- CVE-2026-33940 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.19
- CVE-2026-33941 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.19
- CVE-2026-33939 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.19
- CVE-2026-33937 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.19
- CVE-2026-33938 Handlebars provides the power necessary to let users build semantic templates. Also affects kibana-8.19