CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

• CWE-20

• https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eedPatch
• https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdkVendor Advisory

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4898A vulnerability was found in SourceCodester Student Result M…5.4
• CVE-2025-48980In Brave Browser Desktop versions prior to 1.83.10 that have…6.5
• CVE-2025-48981An insecure implementation of the proprietary protocol DNET …8.6
• CVE-2025-48982This vulnerability in Veeam Agent for Microsoft Windows allo…7.8
• CVE-2025-48983A vulnerability in the Mount service of Veeam Backup & Repli…9.9
• CVE-2025-48984A vulnerability allowing remote code execution (RCE) on the …8.8
• CVE-2025-48986Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and …8.8
• CVE-2025-48987Improper Neutralization of Input in Revive Adserver 5.5.2 an…6.1
• CVE-2025-48988Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2025-48989Improper Resource Shutdown or Release vulnerability in Apach…7.5
• CVE-2025-4899A vulnerability was found in Campcodes Sales and Inventory S…9.8
• CVE-2025-48990NeKernal is a free and open-source operating system stack. V…8.6