CVE-2025-48985: Input Validation Bypass on AI SDK
By Steven Van ·
A file-upload validation bypass in the AI SDK is fixed in versions 5.0.52 and 6.0.0-beta.*.
Vercel fixed a low-severity vulnerability in its AI SDK that could let attackers bypass filetype validation when files were uploaded through generateText() or streamText().
The bug was in the prompt conversion pipeline's convert-to-language-model-prompt.ts file. When a prompt mixed supported and unsupported URLs, filtering out null entries for supported URLs could misalign the downloaded files array with the original planned downloads, causing bytes from an unsupported URL to be mapped to a supported URL's slot. That let attackers inject arbitrary content while bypassing URL-based trust and content validation, unless an application implemented its own file validation outside the SDK.
The issue is fixed in 5.0.52 and 6.0.0-beta.*, and Vercel is encouraging customers to upgrade. Until upgrading, the workaround is to implement custom filetype validation outside the SDK. The vulnerability, tracked as CVE-2025-48985, was responsibly disclosed by @aphantom.