PT-2026-41588

Name of the Vulnerable Software and Affected Versions vercel ai versions prior to 3.0.98 Description A resource consumption issue exists in the provider-utils component. The flaw is located within the createJsonResponseHandler and createJsonErrorResponseHandler functions in the...

GHSA-2JRP-274C-JHV3 Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling

Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...

MAL-2025-190977 Malicious code in n8n-nodes-vercel-ai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3e7549add420dd6e29fcc100779e22f42e36e3d6a194d64ac5cefe5a764971 The package n8n-nodes-vercel-ai-sdk was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199066

Malicious code in n8n-nodes-vercel-ai-sdk npm...

Malicious code in n8n-nodes-vercel-ai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3e7549add420dd6e29fcc100779e22f42e36e3d6a194d64ac5cefe5a764971 The package n8n-nodes-vercel-ai-sdk was found to contain malicious code. Source: ghsa-malware...

Incorrect Behavior Order

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Incorrect Behavior Order via the downloadAssets function. An attacker can upload files with disallowed types by substituting arbitrary downloaded bytes for differe...

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

PT-2025-45397

Name of the Vulnerable Software and Affected Versions Vercel AI SDK versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta Description A flaw exists in Vercel’s AI SDK that could allow users to bypass filetype whitelists during file uploads. This bypass could potentially lead to unauthorized file uploads...

PT-2025-45770

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade...

CVE-2025-48985: Improper Input Validation

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...