litellm
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 84 advisory(ies) without a verdict
Advisories (85)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters | < 1.88.6 ; 1.89.0 – < 1.89.7 ; 1.90.0 – < 1.90.7 ; … | Undetermined |
| GHSA-3xr8-qfvj-9p9j Arbitrary file deletion in litellm | < 1.35.36 | Undetermined |
| GHSA-46cm-pfwv-cgf8 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint | < 1.34.42 | Undetermined |
| GHSA-4g5m-c9r5-49xf LiteLLM: Local file read via request-supplied OIDC file references | < 1.83.10 | Undetermined |
| GHSA-4jcj-7x88-m979 LiteLLM: MCP Proxy Has Improper Authentication | < 1.84.0 | Undetermined |
| GHSA-4xpc-pv4p-pm3w LiteLLM: Authentication Bypass via Host Header Injection | < 1.84.0 | Undetermined |
| GHSA-53gh-p8jc-7rg8 LiteLLM Vulnerable to Remote Code Execution (RCE) | 1.40.3.dev2 – 1.40.12 | Undetermined |
| GHSA-53mr-6c8q-9789 LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint | < 1.83.0 | Undetermined |
| GHSA-5jmr-gcrj-2c9q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction | < 1.83.7 | Undetermined |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware | 1.82.7 – 1.82.8 | Undetermined |
| GHSA-69x8-hrgq-fjj8 LiteLLM: Password hash exposure and pass-the-hash authentication bypass | < 1.83.0 | Undetermined |
| GHSA-6qr3-3g89-m4jj LiteLLM: Admin Key Handler Has Improper Authorization | ≤ 1.63.1 | Undetermined |
| GHSA-6wvf-77m9-58rm LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint | < 1.83.7 | Undetermined |
| GHSA-72m8-9m7m-h278 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks | < 1.82.0 | Undetermined |
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | < 1.84.0 | Undetermined |
| GHSA-7ggm-4rjg-594w litellm passes untrusted data to `eval` function without sanitization | ≤ 1.28.11 | Undetermined |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | 1.91.0 – < 1.100.4 ; 1.101.0 – < 1.101.3 ; 1.102.0 – < 1.102.2 ; … | Undetermined |
| GHSA-879v-fggm-vxw2 LiteLLM Has a Leakage of Langfuse API Keys | ≤ 1.52.1 | Undetermined |
| GHSA-8j42-pcfm-3467 SQL injection in litellm | ≤ 1.27.14 | Undetermined |
| GHSA-c693-x898-5g4h BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader | ≤ 1.82.2 | Undetermined |
| GHSA-fh2c-86xm-pm2x LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request | < 1.56.2 | Undetermined |
| GHSA-fjcf-3j3r-78rp LiteLLM Has an Improper Authorization Vulnerability | < 1.61.15 | Undetermined |
| GHSA-g26j-5385-hhw3 LiteLLM Server-Side Request Forgery (SSRF) vulnerability | < 1.44.8 | Undetermined |
| GHSA-g5ff-637f-6q2m LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` | < 1.95.0 | Undetermined |
| GHSA-g5pg-73fc-hjwq LiteLLM Reveals Portion of API Key via a Logging File | < 1.44.12 | Undetermined |
| GHSA-gppg-gqw8-wh9g litellm vulnerable to remote code execution based on using eval unsafely | < 1.40.16 | Undetermined |
| GHSA-gw2q-qw9j-rgv7 LiteLLM Vulnerable to Denial of Service (DoS) | < 1.53.1.dev1 | Undetermined |
| GHSA-h6m6-jj8v-94jj SQL injection in litellm | < 1.40.0 | Undetermined |
| GHSA-hhww-mrg2-969h LiteLLM vulnerable to reflected XSS in /sso/debug/callback | 1.65.5 – < 1.85.0 | Undetermined |
| GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter | < 1.83.9 | Undetermined |
| GHSA-j37q-q7p9-vpwm LiteLLM: SSO Debug Flow Has Improper Authentication | ≤ 1.82.2 | Undetermined |
| GHSA-jjhc-v7c2-5hh6 LiteLLM: Authentication bypass via OIDC userinfo cache key collision | < 1.83.0 | Undetermined |
| GHSA-m2v5-74w2-qhcj BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure | ≤ 1.82.2 | Undetermined |
| GHSA-mf52-j94g-746m LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration | ≤ 1.82.2 | Undetermined |
| GHSA-p897-vf7j-f5h8 BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints | ≤ 1.82.5 | Undetermined |
| GHSA-qmf3-4767-5fg3 LiteLLM: M2M JWT Handler Has Improper Authorization | ≤ 1.82.2 | Undetermined |
| GHSA-qqcv-vg9f-5rr3 litellm vulnerable to improper access control in team management | < 1.40.15 | Undetermined |
| GHSA-qrc4-49gv-mv9m LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit | < 1.83.14 | Undetermined |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification | 1.81.16 – < 1.83.7 | Undetermined |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints | 1.74.2 – < 1.83.7 | Undetermined |
| GHSA-w2mh-qq9q-453x BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens | ≤ 1.82.2 | Undetermined |
| GHSA-wpfp-gwwc-vwq6 LiteLLM allows a user to modify their own user_role via the /user/update endpoint | < 1.83.10 | Undetermined |
| GHSA-wxxx-gvqv-xp7p LiteLLM has a sandbox escape in custom-code guardrail | 1.81.8 – < 1.83.10 | Undetermined |
| GHSA-xqmj-j6mv-4862 LiteLLM: Server-Side Template Injection in /prompts/test endpoint | 1.80.5 – < 1.83.7 | Undetermined |
| MAL-2026-2144 Malicious code in litellm (PyPI) | 1.82.7, 1.82.8, 1.107.0 | Not affected |
| PYSEC-2026-1540 Arbitrary file deletion in litellm | < 1.35.36 | Undetermined |
| PYSEC-2026-1541 LiteLLM Vulnerable to Remote Code Execution (RCE) | 1.40.3.dev2 – 1.40.12 | Undetermined |
| PYSEC-2026-1542 litellm passes untrusted data to `eval` function without sanitization | ≤ 1.28.11 | Undetermined |
| PYSEC-2026-1543 LiteLLM Has a Leakage of Langfuse API Keys | ≤ 1.52.1 | Undetermined |
| PYSEC-2026-1544 SQL injection in litellm | ≤ 1.27.14 | Undetermined |
| PYSEC-2026-1545 LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request | < 1.56.2 | Undetermined |
| PYSEC-2026-1546 LiteLLM Has an Improper Authorization Vulnerability | < 1.61.15 | Undetermined |
| PYSEC-2026-1547 LiteLLM Server-Side Request Forgery (SSRF) vulnerability | < 1.44.8 | Undetermined |
| PYSEC-2026-1548 LiteLLM Reveals Portion of API Key via a Logging File | < 1.44.12 | Undetermined |
| PYSEC-2026-1549 LiteLLM Vulnerable to Denial of Service (DoS) | < 1.53.1.dev1 | Undetermined |
| PYSEC-2026-1550 SQL injection in litellm | < 1.40.0 | Undetermined |
| PYSEC-2026-1551 litellm vulnerable to improper access control in team management | < 1.40.15 | Undetermined |
| PYSEC-2026-2 Two litellm versions published containing credential harvesting malware | 1.82.7 – 1.82.8 | Undetermined |
| PYSEC-2026-2597 LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint | < 1.83.0 | Undetermined |
| PYSEC-2026-2598 LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit | < 1.83.14 | Undetermined |
| PYSEC-2026-2599 LiteLLM: Authenticated command execution via MCP stdio test endpoints | 1.74.2 – < 1.83.7 | Undetermined |
| PYSEC-2026-2600 LiteLLM allows a user to modify their own user_role via the /user/update endpoint | < 1.83.10 | Undetermined |
| PYSEC-2026-2601 LiteLLM has a sandbox escape in custom-code guardrail | 1.81.8 – < 1.83.10 | Undetermined |
| PYSEC-2026-2602 LiteLLM: Server-Side Template Injection in /prompts/test endpoint | 1.80.5 – < 1.83.7 | Undetermined |
| PYSEC-2026-3476 LiteLLM: Local file read via request-supplied OIDC file references | < 1.83.10 | Undetermined |
| PYSEC-2026-3477 LiteLLM: Arbitrary file write via path traversal in Skills archive extraction | < 1.83.7 | Undetermined |
| PYSEC-2026-3478 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks | < 1.82.0 | Undetermined |
| PYSEC-2026-3479 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | < 1.84.0 | Undetermined |
| PYSEC-2026-3861 LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint | < 1.83.7 | Undetermined |
| PYSEC-2026-387 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint | < 1.34.42 | Undetermined |
| PYSEC-2026-388 LiteLLM: Authentication Bypass via Host Header Injection | < 1.84.0 | Undetermined |
| PYSEC-2026-389 litellm vulnerable to remote code execution based on using eval unsafely | < 1.40.16 | Undetermined |
| PYSEC-2026-390 LiteLLM: Authentication bypass via OIDC userinfo cache key collision | < 1.83.0 | Undetermined |
| PYSEC-2026-391 LiteLLM has SQL Injection in Proxy API key verification | 1.81.16 – < 1.83.7 | Undetermined |
| PYSEC-2026-4066 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters | < 1.88.6 ; 1.89.0 – < 1.89.7 ; 1.90.0 – < 1.90.7 ; … | Undetermined |
| PYSEC-2026-4067 LiteLLM: MCP Proxy Has Improper Authentication | < 1.84.0 | Undetermined |
| PYSEC-2026-4068 LiteLLM: Admin Key Handler Has Improper Authorization | ≤ 1.63.1 | Undetermined |
| PYSEC-2026-4069 BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader | ≤ 1.82.2 | Undetermined |
| PYSEC-2026-4070 LiteLLM Proxy has server-side request forgery via the `user_config` request parameter | < 1.83.9 | Undetermined |
| PYSEC-2026-4071 LiteLLM: SSO Debug Flow Has Improper Authentication | ≤ 1.82.2 | Undetermined |
| PYSEC-2026-4072 BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure | ≤ 1.82.2 | Undetermined |
| PYSEC-2026-4073 LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration | ≤ 1.82.2 | Undetermined |
| PYSEC-2026-4074 BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints | ≤ 1.82.5 | Undetermined |
| PYSEC-2026-4075 LiteLLM: M2M JWT Handler Has Improper Authorization | ≤ 1.82.2 | Undetermined |
| PYSEC-2026-4076 BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens | ≤ 1.82.2 | Undetermined |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-3926-2jvf-fg29 Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail · withdrawn
Sources
| Source | Licence |
|---|