Homepage

litellm@1.65.3 vulnerabilities

Library to easily interface with LLM API providers

  • latest version

    1.66.3

  • latest non vulnerable version

    1.66.3

  • first published

    1 years ago

  • latest version published

    1 days ago

  • licenses detected

  • View litellm package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the litellm package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Arbitrary Command Injection

    litellm is a Library to easily interface with LLM API providers

    Affected versions of this package are vulnerable to Arbitrary Command Injection through the post_call_rules configuration. An attacker can execute arbitrary commands by setting a system method, such as os.system, as a callback, which is executed when a chat response is processed.

    How to fix Arbitrary Command Injection?

    Upgrade litellm to version 1.65.5 or higher.

    [,1.65.5)
    • H
    Exposure of Sensitive Information Through Metadata

    litellm is a Library to easily interface with LLM API providers

    Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata due to an issue in proxy_server.py. An attacker can obtain sensitive information, including API keys, by triggering error conditions during the parsing of team settings.

    How to fix Exposure of Sensitive Information Through Metadata?

    Upgrade litellm to version 1.65.5 or higher.

    [,1.65.5)
    Go back to all versions of this package