CVE-2025-48985: Input Validation Bypass on AI SDK
Vercel's AI SDK had a critical flaw. Attackers could swap file content while bypassing validation. Here's what builders need to know.
Why it matters
A low-severity but exploitable vulnerability in Vercel's widely-used AI SDK allowed arbitrary file injection through index misalignment in the prompt conversion pipeline. Developers building with AI SDKs need to understand the attack surface and upgrade immediately.
The key facts
16 to knowCVE-2025-48985: Input validation bypass in Vercel AI SDK
Affects generateText() and streamText() functions
Vulnerability: index misalignment between downloadedFiles array and plannedDownloads array in convert-to-language-model-prompt.ts
Impact: Attackers could substitute arbitrary downloaded bytes for different supported URLs, bypassing URL-based trust and content validation
Severity: Low (but exploitable for content injection)
Fixed in: v5.0.52 and v6.0.0-beta.*
Affects most methods accepting images or files as inputs unless custom validation implemented
Responsibly disclosed by @aphantom
Published: November 6, 2025
Affected versions: pre-5.0.52 and pre-6.0.0-beta
Root cause: Index misalignment in convert-to-language-model-prompt.ts during URL-to-data mapping
Impact: Attackers could bypass filetype whitelists and inject arbitrary content via URL substitution
Affected functions: generateText() and streamText()
Severity: Low (but widespread application impact)
Fix: File mapping implemented before filtering to retain correct index
Workaround available: Custom filetype validation outside SDK
Go to the source
Vercel Blogvercel.com
Publisher excerpt: A low-severity in Vercel's AI SDK was responsibly disclosed, and has been fixed for 5.0.52, 6.0.0-beta.* The issue may have allowed users to bypass filetype whitelists when uploading files. security vulnerability Vercel customers are encouraged to upgrade to the latest version. Read more details…