Skip to content
OpenAdvisories

Package · PyPI

litellm

45 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-114612 Public exploit

    LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authen…

    BerriAI litellm litellm PyPI
  • Critical 9.8
    CVE-2026-37004

    LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

    BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxe…

    litellm PyPI
  • Critical 9.5
    CVE-2026-49468 Public exploit Scanner template

    LiteLLM: Authentication Bypass via Host Header Injection

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth laye…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • Critical 9.3
    CVE-2026-42208 Exploited Public exploit Scanner template EPSS 89%

    LiteLLM: SQL injection in Proxy API key verification

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing i…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
    KEV May 8, 2026
  • Critical 9.4
    CVE-2026-35030 Public exploit

    LiteLLM has an authentication bypass via OIDC userinfo cache key collision

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signi…

    BerriAI litellm airflow-3 litellm Wolfi PyPI
  • Critical —
    GHSA-5mg7-485q-xm76

    Two LiteLLM versions published containing credential harvesting malware

    After an API Token exposure from an exploited trivy dependency, two new releases of `litellm` were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. Anyone who has instal…

    litellm PyPI
  • Critical 9.8
    CVE-2024-5751

    Remote Code Execution in BerriAI/litellm

    BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.envir…

    BerriAI berriai/litellm litellm PyPI
  • Critical 9.8
    CVE-2024-4264

    Remote Code Execution in berriai/litellm

    A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` function unsafely in the `litellm.get_secret()` method. Specifically, when the server utilizes Google KMS…

    BerriAI berriai/litellm litellm PyPI
  • Critical 9.8
    CVE-2024-2952

    Server-Side Template Injection in BerriAI/litellm

    BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinj…

    BerriAI berriai/litellm litellm PyPI