EUVD-2025-7124

Malicious code in bioql PyPI...

EUVD-2025-6882

Malicious code in bioql PyPI...

EUVD-2025-6847

Malicious code in bioql PyPI...

LiteLLM Information health API_KEY Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the APIKEY parameter provided to the health endpoint. The issue results from...

PT-2025-40610

LiteLLM Information health API KEY Information Disclosure Vulnerability...

01os (>=0.0.1 <=0.0.14), advanced-research (>=0.1.0 <=0.2.2) +416 more potentially affected by unknown CVE via litellm (>=1.0.0 <=1.77.0)

litellm PYPI version =1.0.0, =0.0.1, =0.1.0, =0.4.0, =0.8.1, =0.1.0, =0.1.39, =0.14.1a0, =0.1.0, =0.0.5, =0.3.1, =1.1.2, =1.4.3, =0.0.1, =0.1.0, =0.7.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-LITELLM-13449204...

Incorrect Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization via incomplete role-based checks in the checkproxyadminvieweraccess function. An attacker can modify user credentials by sending crafted requests to...

01os (>=0.0.1 <=0.0.14), advanced-research (>=0.1.0 <=0.2.2) +410 more potentially affected by unknown CVE via litellm (>=1.0.0 <=1.76.2)

litellm PYPI version =1.0.0, =0.0.1, =0.1.0, =0.4.0, =0.8.1, =0.1.0, =0.1.39, =0.14.1a0, =0.1.0, =0.0.5, =0.3.1, =1.1.2, =1.4.3, =0.0.1, =0.1.0, =0.7.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-LITELLM-13449666...

Missing Authentication for Critical Function

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Missing Authentication for Critical Function via sensitive in-memory cache debug endpoints. An unauthenticated attacker can access sensitive cached information by accessing...

CVE-2025-45809

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints...

aeiva (>=0.8.1 <=0.8.2.6), ag-ui-crewai (>=0.1.0 <=0.2.0) +214 more potentially affected by CVE-2025-45809 via litellm (>=1.48.7 <=1.74.9)

litellm PYPI version =1.48.7, =0.8.1, =0.1.0, =0.1.0, =0.3.1, =1.1.2, =1.4.3, =0.1.0, =0.2.0, =0.1.1, =0.5.0, =0.1.0, =0.61.0, =0.85.2 and more Source cves: CVE-2025-45809 Source advisory: SNYK:PYTHON-LITELLM-10598343...

SQL Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to SQL Injection via the /key/block endpoint. A proxyadminviewer user can retrieve the contents of arbitrary files on the target filesystem by brute forcing them one character...

CVE-2025-45809

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints...

CVE-2025-45809

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints...

CVE-2024-5225

An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...

CVE-2024-4888

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

CVE-2024-4890

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...

SQL Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to SQL Injection via spendmanagementendpoints.py. An attacker could potentially inject malicious SQL code through unsanitized input, leading to unauthorized data access or...

01os (>=0.0.1 <=0.0.13), aeiva (>=0.8.1 <=0.8.2.6) +218 more potentially affected by unknown CVE via litellm (>=1.0.0 <=1.67.4)

litellm PYPI version =1.0.0, =0.0.1, =0.8.1, =0.14.1a0, =0.1.0, =0.0.5, =1.1.2, =0.0.4, =0.2.0, =0.1.1, =0.5.0, =0.1.0, =1.0.3, =0.2.10, =0.29.0, =0.82.2 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-LITELLM-10300818...

01os (>=0.0.1 <=0.0.13), aeiva (>=0.8.1 <=0.8.2.6) +193 more potentially affected by unknown CVE via litellm (>=1.0.0 <=1.63.7)

litellm PYPI version =1.0.0, =0.0.1, =0.8.1, =0.14.1a0, =0.1.0, =0.0.5, =1.1.2, =0.0.4, =0.2.0, =0.1.1, =0.5.0, =0.1.0, =1.0.3, =0.2.10, =0.29.0, =0.59.1, =0.62.9 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-LITELLM-9667338...