litellm

45 results · Feed

• Medium 6.5
  CVE-2024-4888

  Arbitrary File Deletion in BerriAI/litellm

  BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file…

  BerriAI berriai/litellm litellm PyPI
  Jun 6, 2024
• Medium 4.9
  CVE-2024-4890

  Blind SQL Injection in berriai/litellm

  A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An at…

  BerriAI berriai/litellm litellm PyPI
  Jun 6, 2024
• Medium 6.4
  CVE-2024-5225

  SQL Injection in berriai/litellm

  An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an…

  BerriAI berriai/litellm litellm PyPI
  Jun 6, 2024
• Critical 9.8
  CVE-2024-4264

  Remote Code Execution in berriai/litellm

  A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` function unsafely in the `litellm.get_secret()` method. Specifically, when the server utilizes Google KMS…

  BerriAI berriai/litellm litellm PyPI
  May 18, 2024
• Critical 9.8
  CVE-2024-2952

  Server-Side Template Injection in BerriAI/litellm

  BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinj…

  BerriAI berriai/litellm litellm PyPI
  Apr 10, 2024