CVE-2024-9606: Improper Output Neutralization for Logs

In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...

CVE-2024-10188: Uncontrolled Resource Consumption

A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service DoS by exploiting the use of ast.literaleval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server...

LiteLLM 资源管理错误漏洞

LiteLLM is a Berri AI open source application. All LLM APIs can be called using the OpenAI format. LiteLLM has a resource management error vulnerability that stems from an insecure parsing of user input in ast.literaleval, which can be exploited by an attacker to cause a denial of service...

LiteLLM 安全漏洞

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A security vulnerability exists in LiteLLM versions prior to 1.44.12, which stems from the API key masking code masking only the first 5 characters, which could lead to API key disclosure...

PT-2025-12027

Name of the Vulnerable Software and Affected Versions BerriAI/litellm version as of commit 26c03c9 Description The issue allows unauthenticated users to cause a Denial of Service DoS by exploiting the use of ast.literal eval to parse user input. This function is not safe and is prone to DoS...

PT-2025-12313

Name of the Vulnerable Software and Affected Versions berriai/litellm version 1.52.1 Description An issue in the proxy server.py file causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This exposes sensitive information, including langfuse secret and langfus...

LiteLLM 安全漏洞

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A security vulnerability exists in LiteLLM v1.52.1, which stems from an error in the parsing team settings that resulted in the disclosure of Langfuse API keys, potentially leading to the...

PT-2025-12256

Name of the Vulnerable Software and Affected Versions berriai/litellm version v1.44.5 Description A Denial of Service DoS vulnerability exists. This vulnerability can be exploited by appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request. The server...

CVE-2024-6825: Improper Control of Generation of Code

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

PT-2025-12165

Name of the Vulnerable Software and Affected Versions BerriAI/litellm version 1.40.12 Description The issue exists in the handling of the post call rules configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the...

PT-2025-12287

Name of the Vulnerable Software and Affected Versions berriai/litellm versions 1.44.9 through 1.44.11 Description The issue affects the litellm/litellm core utils/litellm logging.py file, where the API key masking code only masks the first 5 characters of the key. This results in the leakage of...

CVE-2024-8984: Allocation of Resources Without Limits or Throttling

A Denial of Service DoS vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource...

CVE-2025-0628: Incorrect Privilege Assignment

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...

CVE-2025-0330: Exposure of Sensitive Information Through Metadata

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

LiteLLM 授权问题漏洞

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. LiteLLM suffers from an authorization issue vulnerability that stems from improper authorization and could lead to elevation of privilege...

LiteLLM 命令注入漏洞

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A command injection vulnerability exists in LiteLLM version 1.40.12, which stems from mishandling of the postcallrules configuration and could lead to remote code execution...

LiteLLM 资源管理错误漏洞

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. A resource management error vulnerability exists in LiteLLM v1.44.5 that stems from not properly handling multi-part boundaries, which could lead to a denial of service attack...

LiteLLM < 1.48.18 Server-Side Request Forgery

According to its self-reported version, the instance of LiteLLM running on the remote web server is prior to 1.48.18. It is, therefore, affected by a Server-Side Request Forgery vulnerability in the chat completion. Note that the scanner has not tested for these issues but has instead relied only...

LiteLLM Default Credentials

LiteLLM applies an authentication system with credentials that could have been suggested from the documentation. If these credentials are not modified, an attacker could access LiteLLM's interface and perform arbitrary actions. This detection is included in the AI and LLM category. No source data...

LiteLLM Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible LiteLLM instance on the target application. LiteLLM is a LLM Gateway to provide model access in the OpenAI format. This detection is included in the AI and LLM category. No source data...