Skip to content
Threat Feed

Product

LiteLLM

3 briefs RSS
critical advisory

LiteLLM Proxy API Key Verification SQL Injection

A SQL injection vulnerability exists in LiteLLM versions 1.81.16 to prior to 1.83.7 allowing an unauthenticated attacker to inject SQL queries via a crafted 'Authorization' header, potentially leading to unauthorized data access or modification.

litellm sqli web-application
2r 1t
high advisory

LiteLLM Server-Side Template Injection Vulnerability

A server-side template injection vulnerability in LiteLLM versions 1.80.5 to before 1.83.7 allows authenticated users to execute arbitrary code within the LiteLLM Proxy process via a crafted prompt template, potentially exposing sensitive information and enabling command execution on the host.

LiteLLM ssti template-injection code-execution
2r 1t
high advisory

LiteLLM Authenticated Command Execution via MCP stdio Test Endpoints

Authenticated users with low-privilege API keys could execute arbitrary commands on the host running LiteLLM via the `/mcp-rest/test/connection` and `/mcp-rest/test/tools/list` endpoints, by submitting a server configuration including command execution parameters.

litellm rce command-injection
2r 1t