CVE-2025-48985: Input Validation Bypass in AI SDK
A low-severity vulnerability in Vercel's AI SDK allowed attackers to bypass filetype whitelists and inject arbitrary content by manipulating URL-to-data mapping in the prompt conversion pipeline. This has been patched in versions 5.0.52 and 6.0.0-beta.
A low-severity in Vercel's AI SDK was responsibly disclosed, and has been fixed for 5.0.52, 6.0.0-beta.* The issue may have allowed users to bypass filetype whitelists when uploading files. security vulnerability
Vercel customers are encouraged to upgrade to the latest version. Read more details below.
Vulnerability in Vercel's AI SDK prompt conversion pipeline where improper URL-to-data mapping allows attackers to substitute arbitrary downloaded bytes for different supported URLs within the same prompt. The vulnerability occurs in the file when filtering downloaded results could cause index misalignment between the downloadedFiles array and the original plannedDownloads array.convert-to-language-model-prompt.ts
When processing mixed supported and unsupported URLs, the filtering operation removes null entries for supported URLs, causing the remaining downloaded data to be incorrectly associated with different URL keys. This results in bytes from an unsupported URL being mapped to a supported URL slot, allowing attackers to inject arbitrary content while bypassing URL-based trust and content validation mechanisms.
This affects most methods that accepted images or files as inputs, unless explicit data validation was implemented outside of the SDK. Namely the and functions.generateText()streamText()
The issue was resolved by mapping files before filtering out empty ones to retain the correct index in:
Thanks to @aphantom for responsible disclosure.
Summary
Impact
Resolution
Workarounds
Credit
References
5.0.52
6.0.0-beta.*
Implementing custom filetype validation logic outside of the SDK.
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.