VDB
Sign up
LOW3.7

GHSA-rwvc-j5jr-mgvh

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

Quick fix

GHSA-rwvc-j5jr-mgvh — ai: upgrade to the fixed version with the command below.

npm install ai@5.0.52

Details

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/ai
Introduced in: 0Fixed in: 5.0.52
Fixnpm install ai@5.0.52
npm/ai
Introduced in: 5.1.0-beta.0Fixed in: 5.1.0-beta.9
Fixnpm install ai@5.1.0-beta.9

References