Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
31 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the apibase parameter when making requests to POST /chat/completions, causing the application to send the request to the domain specified by apibase. This request includes the OpenAI API key. A malicious user can set the apibase to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.
Recommended action: Upgrade to 1.44.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.
Recommended action: Upgrade to 1.40.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the adddeployment function, which decodes and decrypts environment variables from base64 and assigns them to os.environ. An attacker can exploit this by sending a malicious payload to the /config/update endpoint, which is then processed and executed by the server when the getsecret function is triggered. This requires the server to use Google KMS and a database to store a model.
Recommended action: Upgrade to 1.40.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated apikey parameter directly into the query, making it susceptible to SQL Injection if the apikey contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).
Recommended action: Upgrade to 1.40.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where os.remove(file.filename) is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.
Recommended action: Upgrade to 1.35.36 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious tokenizerconfig.json files that execute arbitrary code on the server.
Recommended action: Upgrade to 1.34.42 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.