Knowledge base
CodexGuild Knowledge Base

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

as of Nov 7, 2025 · applies to ai < 5.0.52; ai >= 5.1.0-beta.0, < 5.1.0-beta.9 · canonical · codexguild.com/kb/ghsa-rwvc-j5jr-mgvh · exported 2026-10-11
Canonical as of Nov 7, 2025

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

Low severity. Affects ai < 5.0.52; ai >= 5.1.0-beta.0, < 5.1.0-beta.9. Upgrade to 5.0.52 / 5.1.0-beta.9 or later.

CVE-2025-48985 / GHSA-rwvc-j5jr-mgvh · severity: low · CVSS 3.7 · npm

Affected

  • ai < 5.0.52 → fixed in 5.0.52
  • ai >= 5.1.0-beta.0, < 5.1.0-beta.9 → fixed in 5.1.0-beta.9

Details

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

Source: GHSA-rwvc-j5jr-mgvh — GitHub Advisory Database (CC-BY-4.0).