litellm (PyPI)
Advisories
101
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.104.0rc2 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "litellm>=1.104.0rc2"poetry
poetry add "litellm>=1.104.0rc2"uv
uv add "litellm>=1.104.0rc2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-g5ff-637f-6q2m LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` |
High | < 1.95.0 | 1.95.0 |
| GHSA-hhww-mrg2-969h LiteLLM vulnerable to reflected XSS in /sso/debug/callback |
Medium | >= 1.65.5, < 1.85.0 | 1.85.0 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
Critical EPSS 0.32% |
>= 1.101.0, < 1.101.3 | 1.101.3 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
Critical EPSS 0.32% |
>= 1.91.0, < 1.100.4 | 1.100.4 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
Critical EPSS 0.32% |
>= 1.103.0, < 1.103.1 | 1.103.1 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
Critical EPSS 0.32% |
>= 1.104.0rc1, < 1.104.0rc2 | 1.104.0rc2 |
| GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key |
Critical EPSS 0.32% |
>= 1.102.0, < 1.102.2 | 1.102.2 |
| GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter |
Medium EPSS 0.44% |
< 1.83.9 | 1.83.9 |
| GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter |
Medium EPSS 0.44% |
< 1.83.9 | 1.83.9 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.96.0, < 1.96.2 | 1.96.2 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
< 1.88.6 | 1.88.6 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
< 1.88.6>= 1.89.0, < 1.89.7>= 1.90.0, < 1.90.7>= 1.91.0, < 1.91.5>= 1.92.0, < 1.92.2>= 1.93.0, < 1.93.2>= 1.94.0, < 1.94.3>= 1.95.0, < 1.95.1>= 1.96.0, < 1.96.2 | 1.88.61.89.71.90.71.91.51.92.21.93.21.94.31.95.11.96.2 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.92.0, < 1.92.2 | 1.92.2 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.95.0, < 1.95.1 | 1.95.1 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.90.0, < 1.90.7 | 1.90.7 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.94.0, < 1.94.3 | 1.94.3 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.93.0, < 1.93.2 | 1.93.2 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.89.0, < 1.89.7 | 1.89.7 |
| GHSA-3cv6-jpf6-8222 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters |
Medium EPSS 0.54% |
>= 1.91.0, < 1.91.5 | 1.91.5 |
| GHSA-6wvf-77m9-58rm LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint |
Critical EPSS 0.80% |
< 1.83.7 | 1.83.7 |
| GHSA-6wvf-77m9-58rm LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint |
Critical EPSS 0.80% |
< 1.83.7 | 1.83.7 |
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback Known exploited |
High EPSS 0.84% |
< 1.84.0 | 1.84.0 |
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback Known exploited |
High EPSS 0.84% |
< 1.84.0 | 1.84.0 |
| GHSA-7488-6r32-c95q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback Known exploited |
High EPSS 0.84% |
< 1.84.0 | 1.84.0 |
| GHSA-72m8-9m7m-h278 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks |
High EPSS 0.90% |
< 1.82.0 | 1.82.0 |
| GHSA-72m8-9m7m-h278 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks |
High EPSS 0.90% |
< 1.82.0 | 1.82.0 |
| GHSA-5jmr-gcrj-2c9q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction |
Medium EPSS 0.59% |
< 1.83.7 | 1.83.7 |
| GHSA-5jmr-gcrj-2c9q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction |
Medium EPSS 0.59% |
< 1.83.7 | 1.83.7 |
| GHSA-4g5m-c9r5-49xf LiteLLM: Local file read via request-supplied OIDC file references |
Medium EPSS 0.57% |
< 1.83.10 | 1.83.10 |
| GHSA-4g5m-c9r5-49xf LiteLLM: Local file read via request-supplied OIDC file references |
Medium EPSS 0.57% |
< 1.83.10 | 1.83.10 |
| GHSA-m2v5-74w2-qhcj BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure |
Medium EPSS 0.43% |
<= 1.82.2 | No fix yet |
| GHSA-m2v5-74w2-qhcj BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure |
Medium EPSS 0.43% |
<= 1.82.2 | No fix yet |
| GHSA-c693-x898-5g4h BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader |
Medium EPSS 0.40% |
<= 1.82.2 | No fix yet |
| GHSA-c693-x898-5g4h BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader |
Medium EPSS 0.40% |
<= 1.82.2 | No fix yet |
| GHSA-p897-vf7j-f5h8 BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints |
Medium EPSS 0.40% |
<= 1.82.5 | No fix yet |
| GHSA-p897-vf7j-f5h8 BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints |
Medium EPSS 0.40% |
<= 1.82.5 | No fix yet |
| GHSA-w2mh-qq9q-453x BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens |
Medium EPSS 0.57% |
<= 1.82.2 | No fix yet |
| GHSA-w2mh-qq9q-453x BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens |
Medium EPSS 0.57% |
<= 1.82.2 | No fix yet |
| GHSA-j37q-q7p9-vpwm LiteLLM: SSO Debug Flow Has Improper Authentication |
High EPSS 0.80% |
<= 1.82.2 | No fix yet |
| GHSA-j37q-q7p9-vpwm LiteLLM: SSO Debug Flow Has Improper Authentication |
High EPSS 0.80% |
<= 1.82.2 | No fix yet |
| GHSA-4jcj-7x88-m979 LiteLLM: MCP Proxy Has Improper Authentication |
Critical EPSS 1.02% |
< 1.84.0 | 1.84.0 |
| GHSA-4jcj-7x88-m979 LiteLLM: MCP Proxy Has Improper Authentication |
Critical EPSS 1.02% |
< 1.84.0 | 1.84.0 |
| GHSA-mf52-j94g-746m LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration |
Medium EPSS 0.40% |
<= 1.82.2 | No fix yet |
| GHSA-mf52-j94g-746m LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration |
Medium EPSS 0.40% |
<= 1.82.2 | No fix yet |
| GHSA-qmf3-4767-5fg3 LiteLLM: M2M JWT Handler Has Improper Authorization |
High EPSS 0.43% |
<= 1.82.2 | No fix yet |
| GHSA-qmf3-4767-5fg3 LiteLLM: M2M JWT Handler Has Improper Authorization |
High EPSS 0.43% |
<= 1.82.2 | No fix yet |
| GHSA-6qr3-3g89-m4jj LiteLLM: Admin Key Handler Has Improper Authorization |
High EPSS 0.57% |
<= 1.63.1 | No fix yet |
| GHSA-6qr3-3g89-m4jj LiteLLM: Admin Key Handler Has Improper Authorization |
High EPSS 0.57% |
<= 1.63.1 | No fix yet |
| GHSA-4xpc-pv4p-pm3w LiteLLM: Authentication Bypass via Host Header Injection |
Critical EPSS 3.03% |
< 1.84.0 | 1.84.0 |
| GHSA-4xpc-pv4p-pm3w LiteLLM: Authentication Bypass via Host Header Injection |
Critical EPSS 3.03% |
< 1.84.0 | 1.84.0 |
| GHSA-wpfp-gwwc-vwq6 LiteLLM allows a user to modify their own user_role via the /user/update endpoint |
High EPSS 0.65% |
< 1.83.10 | 1.83.10 |
| GHSA-wpfp-gwwc-vwq6 LiteLLM allows a user to modify their own user_role via the /user/update endpoint |
High EPSS 0.65% |
< 1.83.10 | 1.83.10 |
| GHSA-qrc4-49gv-mv9m LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit |
High EPSS 1.19% |
< 1.83.14 | 1.83.14 |
| GHSA-qrc4-49gv-mv9m LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit |
High EPSS 1.19% |
< 1.83.14 | 1.83.14 |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints Known exploited |
High EPSS 91.44% |
>= 1.74.2, < 1.83.7 | 1.83.7 |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints Known exploited |
High EPSS 91.44% |
>= 1.74.2, < 1.83.7 | 1.83.7 |
| GHSA-v4p8-mg3p-g94g LiteLLM: Authenticated command execution via MCP stdio test endpoints Known exploited |
High EPSS 91.44% |
>= 1.74.2, < 1.83.7 | 1.83.7 |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification Known exploited |
Critical EPSS 89.42% |
>= 1.81.16, < 1.83.7 | 1.83.7 |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification Known exploited |
Critical EPSS 89.42% |
>= 1.81.16, < 1.83.7 | 1.83.7 |
| GHSA-r75f-5x8p-qvmc LiteLLM has SQL Injection in Proxy API key verification Known exploited |
Critical EPSS 89.42% |
>= 1.81.16, < 1.83.7 | 1.83.7 |
| GHSA-xqmj-j6mv-4862 LiteLLM: Server-Side Template Injection in /prompts/test endpoint |
High EPSS 0.37% |
>= 1.80.5, < 1.83.7 | 1.83.7 |
| GHSA-xqmj-j6mv-4862 LiteLLM: Server-Side Template Injection in /prompts/test endpoint |
High EPSS 0.37% |
>= 1.80.5, < 1.83.7 | 1.83.7 |
| GHSA-3926-2jvf-fg29 Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail Withdrawn |
High | >= 1.81.8, < 1.83.10 | 1.83.10 |
| GHSA-wxxx-gvqv-xp7p LiteLLM has a sandbox escape in custom-code guardrail |
High EPSS 15.53% |
>= 1.81.8, < 1.83.10 | 1.83.10 |
| GHSA-wxxx-gvqv-xp7p LiteLLM has a sandbox escape in custom-code guardrail |
High EPSS 15.53% |
>= 1.81.8, < 1.83.10 | 1.83.10 |
| GHSA-69x8-hrgq-fjj8 LiteLLM: Password hash exposure and pass-the-hash authentication bypass |
High | < 1.83.0 | 1.83.0 |
| GHSA-jjhc-v7c2-5hh6 LiteLLM: Authentication bypass via OIDC userinfo cache key collision |
Critical EPSS 0.62% |
< 1.83.0 | 1.83.0 |
| GHSA-jjhc-v7c2-5hh6 LiteLLM: Authentication bypass via OIDC userinfo cache key collision |
Critical EPSS 0.62% |
< 1.83.0 | 1.83.0 |
| GHSA-53mr-6c8q-9789 LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint |
High EPSS 38.61% |
< 1.83.0 | 1.83.0 |
| GHSA-53mr-6c8q-9789 LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint |
High EPSS 38.61% |
< 1.83.0 | 1.83.0 |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware |
Critical | >= 1.82.7, <= 1.82.8 | No fix yet |
| MAL-2026-2144 Malicious code in litellm (PyPI) |
Not rated yet | >= 1.82.7, <= 1.82.8 | No fix yet |
| MAL-2026-2144 Malicious code in litellm (PyPI) |
Not rated yet | No fix yet | |
| GHSA-fjcf-3j3r-78rp LiteLLM Has an Improper Authorization Vulnerability |
High EPSS 0.34% |
< 1.61.15 | 1.61.15 |
| GHSA-fjcf-3j3r-78rp LiteLLM Has an Improper Authorization Vulnerability |
High EPSS 0.34% |
< 1.61.15 | 1.61.15 |
| GHSA-879v-fggm-vxw2 LiteLLM Has a Leakage of Langfuse API Keys |
High EPSS 0.57% |
<= 1.52.1 | No fix yet |
| GHSA-879v-fggm-vxw2 LiteLLM Has a Leakage of Langfuse API Keys |
High EPSS 0.57% |
<= 1.52.1 | No fix yet |
| GHSA-g5pg-73fc-hjwq LiteLLM Reveals Portion of API Key via a Logging File |
High EPSS 0.77% |
< 1.44.12 | 1.44.12 |
| GHSA-g5pg-73fc-hjwq LiteLLM Reveals Portion of API Key via a Logging File |
High EPSS 0.77% |
< 1.44.12 | 1.44.12 |
| GHSA-fh2c-86xm-pm2x LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request |
High EPSS 0.86% |
< 1.56.2 | 1.56.2 |
| GHSA-fh2c-86xm-pm2x LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request |
High EPSS 0.86% |
< 1.56.2 | 1.56.2 |
| GHSA-53gh-p8jc-7rg8 LiteLLM Vulnerable to Remote Code Execution (RCE) |
High EPSS 1.65% |
>= 1.40.3.dev2, <= 1.40.12 | No fix yet |
| GHSA-53gh-p8jc-7rg8 LiteLLM Vulnerable to Remote Code Execution (RCE) |
High EPSS 1.65% |
>= 1.40.3.dev2, <= 1.40.12 | No fix yet |
| GHSA-gw2q-qw9j-rgv7 LiteLLM Vulnerable to Denial of Service (DoS) |
High EPSS 0.57% |
< 1.53.1.dev1 | 1.53.1.dev1 |
| GHSA-gw2q-qw9j-rgv7 LiteLLM Vulnerable to Denial of Service (DoS) |
High EPSS 0.57% |
< 1.53.1.dev1 | 1.53.1.dev1 |
| GHSA-g26j-5385-hhw3 LiteLLM Server-Side Request Forgery (SSRF) vulnerability |
High EPSS 34.38% |
< 1.44.8 | 1.44.8 |
| GHSA-g26j-5385-hhw3 LiteLLM Server-Side Request Forgery (SSRF) vulnerability |
High EPSS 34.38% |
< 1.44.8 | 1.44.8 |
| GHSA-gppg-gqw8-wh9g litellm vulnerable to remote code execution based on using eval unsafely |
Critical EPSS 0.88% |
< 1.40.16 | 1.40.16 |
| GHSA-gppg-gqw8-wh9g litellm vulnerable to remote code execution based on using eval unsafely |
Critical EPSS 0.88% |
< 1.40.16 | 1.40.16 |
| GHSA-qqcv-vg9f-5rr3 litellm vulnerable to improper access control in team management |
Medium EPSS 0.41% |
< 1.40.15 | 1.40.15 |
| GHSA-qqcv-vg9f-5rr3 litellm vulnerable to improper access control in team management |
Medium EPSS 0.41% |
< 1.40.15 | 1.40.15 |
| GHSA-h6m6-jj8v-94jj SQL injection in litellm |
High EPSS 0.43% |
< 1.40.0 | 1.40.0 |
| GHSA-h6m6-jj8v-94jj SQL injection in litellm |
High EPSS 0.43% |
< 1.40.0 | 1.40.0 |
| GHSA-8j42-pcfm-3467 SQL injection in litellm |
Medium EPSS 0.56% |
<= 1.27.14 | No fix yet |
| GHSA-8j42-pcfm-3467 SQL injection in litellm |
Medium EPSS 0.56% |
<= 1.27.14 | No fix yet |
| GHSA-3xr8-qfvj-9p9j Arbitrary file deletion in litellm |
High EPSS 0.62% |
< 1.35.36 | 1.35.36 |
| GHSA-3xr8-qfvj-9p9j Arbitrary file deletion in litellm |
High EPSS 0.62% |
< 1.35.36 | 1.35.36 |
| GHSA-7ggm-4rjg-594w litellm passes untrusted data to `eval` function without sanitization |
Critical EPSS 0.88% |
<= 1.28.11 | No fix yet |
| GHSA-7ggm-4rjg-594w litellm passes untrusted data to `eval` function without sanitization |
Critical EPSS 0.88% |
<= 1.28.11 | No fix yet |
| GHSA-46cm-pfwv-cgf8 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint |
Critical EPSS 1.27% |
< 1.34.42 | 1.34.42 |
| GHSA-46cm-pfwv-cgf8 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint |
Critical EPSS 1.27% |
< 1.34.42 | 1.34.42 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor