CVE-2025-48985: Vercel AI SDK Auth Bypass Vulnerability

CVE-2025-48985 Overview

CVE-2025-48985 is an input validation vulnerability [CWE-20] in Vercel's AI SDK. The flaw allowed users to bypass filetype whitelist controls when uploading files through the SDK. The issue stems from how the SDK handled intermediate file downloads during prompt conversion to language model inputs. When an intermediate file could not be downloaded, the filtering logic did not correctly preserve alignment between planned downloads and validated results, permitting attacker-controlled content to bypass allow-list checks.

Vercel has published fixes in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. All users of the ai package are encouraged to upgrade.

Critical Impact
Attackers can bypass filetype whitelist validation and supply disallowed file content to downstream language model prompts, undermining input sanitization controls.

Affected Products

Vercel AI SDK versions prior to 5.0.52
Vercel AI SDK 5.1.0-beta.0 through 5.1.0-beta.8
Vercel AI SDK 6.0.0 pre-beta releases

Discovery Timeline

2025-11-07 - CVE-2025-48985 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48985

Vulnerability Analysis

The vulnerability resides in the Vercel AI SDK's prompt conversion pipeline, specifically in packages/ai/src/prompt/convert-to-language-model-prompt.ts. This module downloads files referenced in prompts and prepares them for consumption by language models. Filetype validation is applied against the results of these downloads.

The original implementation filtered downloaded files before mapping them back to their planned download URLs. When one or more intermediate downloads failed, index alignment between the filtered array and the plannedDownloads array was broken. The wrong URL keys could then be paired with successful downloads, allowing content that should have been rejected by whitelist logic to enter the model prompt.

The issue is a classic improper input validation weakness [CWE-20], where allow-list enforcement depended on ordered array positions that no longer held after filtering.

Root Cause

The root cause is order-dependent filtering. The .filter() operation removed null entries before the subsequent .map() used the remaining index positions to look up plannedDownloads[index]. Any failed intermediate download shifted indexes and misaligned URLs with downloaded data, breaking filetype checks tied to those URLs.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. An attacker crafts a prompt referencing multiple files where at least one intermediate download intentionally fails, causing subsequent file entries to be mapped to the wrong URL and bypassing the filetype whitelist.

typescript

// Security patch from packages/ai/src/prompt/convert-to-language-model-prompt.ts
// The fix maps first (preserving index alignment with plannedDownloads),
// then filters out null entries — so failed downloads no longer shift indexes.
return Object.fromEntries(
  downloadedFiles
    .map((file, index) =>
      file == null
        ? null
        : [
            plannedDownloads[index].url.toString(),
            { data: file.data, mediaType: file.mediaType },
          ],
    )
    .filter(file => file != null),
);

Source: Vercel AI GitHub commit 930399b

Detection Methods for CVE-2025-48985

Indicators of Compromise

Application logs showing partial or failed intermediate file downloads followed by successful prompt processing containing non-whitelisted media types.
Unexpected mediaType values in language model prompt payloads that do not match the application's declared filetype allow-list.
Outbound requests from AI SDK workers to attacker-controlled URLs that return non-200 responses paired with successful adjacent downloads.

Detection Strategies

Inventory Node.js dependencies for the ai package and flag versions below 5.0.52, or pre-beta.9 versions on the 5.1.x branch.
Add runtime logging around the convert-to-language-model-prompt code path to record each planned URL, its download status, and the final mediaType accepted into the prompt.
Correlate application telemetry with egress traffic to detect prompts referencing multiple files where at least one download failed.

Monitoring Recommendations

Alert on repeated prompt requests from a single identity that include multiple file references with mixed success/failure outcomes.
Monitor changes to package.json and package-lock.json in CI/CD to enforce a minimum patched version of the ai package.
Track anomalies in accepted mediaType distributions over time to surface whitelist bypass attempts.

How to Mitigate CVE-2025-48985

Immediate Actions Required

Upgrade the Vercel AI SDK to 5.0.52, 5.1.0-beta.9, 6.0.0-beta, or later on all applications that consume file inputs.
Rebuild and redeploy any container images and serverless bundles that pinned a vulnerable version of the ai package.
Re-run application-level filetype validation on any files processed by prompts during the exposure window.

Patch Information

The fix is delivered in the upstream commit 930399bb9839a8baf3d349614106d78268775eed and shipped in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. See the Vercel CVE-2025-48985 Advisory and the GitHub commit change for full details.

Workarounds

Enforce filetype validation independently at the application layer, using content-based checks such as magic-byte inspection rather than URL or metadata alone.
Reject prompt requests where any referenced file download fails, rather than proceeding with a partial result set.
Restrict outbound egress from AI SDK workloads to a curated allow-list of file hosts to reduce the attacker's ability to stage malicious downloads.

bash

# Upgrade the Vercel AI SDK to a patched release
npm install ai@5.0.52
# or, for the 5.1 beta channel
npm install ai@5.1.0-beta.9
# or, for the 6.0 beta channel
npm install ai@6.0.0-beta

# Verify the installed version
npm ls ai