litellm@1.83.5

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Directory Traversal via path traversal in the skill archive extraction logic in SkillPromptInjectionHandler and SkillsSandboxExecutor. An authenticated user with access to the Skills API, or a key allowed to call /v1/skills, anthropic_routes, or llm_api_routes, can upload a crafted ZIP archive with ../ or absolute-path entries to make extraction write files outside the intended staging directory. That lets the attacker overwrite files on the host, which can corrupt the deployment or place executable content in writable locations and lead to code execution depending on the runtime environment and filesystem permissions.

Notes

• The archive extraction path handling is only exercised when a skill ZIP is processed for execution, so deployments that expose Skills upload/processing through /v1/skills, anthropic_routes, or llm_api_routes are the relevant exposure points; ordinary LiteLLM use without those routes is not in scope.
• The write primitive depends on the staging directory being used to materialize extracted files on disk, so impact is constrained by the runtime’s filesystem permissions and whatever writable locations the LiteLLM process can reach.

Workarounds

• Block POST /v1/skills at your reverse proxy or API gateway to prevent uploading crafted skill archives that can trigger the path traversal write.
• Restrict Skills API access to trusted users only to limit who can submit malicious ZIP archives through /v1/skills, anthropic_routes, or llm_api_routes.

Upgrade litellm to version 1.83.7 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to External Control of File Name or Path via request-supplied OIDC file references through the /health/test_connection handler in litellm/proxy/health_endpoints/_health_endpoints.py and litellm/secret_managers/main.py. An attacker with privileged access to the proxy can read arbitrary local files by sending a litellm_params payload that points an oidc/file/ secret reference at a filesystem path such as /etc/passwd or another credential file. This exposes file contents to the caller during connection testing, letting a proxy administrator or other authorized model-connection tester retrieve secrets from the host filesystem instead of only using server-managed credential locations.

Notes

• oidc/file/ resolution is constrained to standard credential mount locations by default (/var/run/secrets and /run/secrets). Deployments that store OIDC material elsewhere need to set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to include those absolute directories, or those reads are rejected.
• The affected request path includes nested litellm_params/metadata fields in the connection-test flow, so the file-reference handling is not limited to a single top-level parameter location.

Upgrade litellm to version 1.83.10 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Incorrect Authorization in the BannedKeywords enterprise and AzureContentSafety hooks of the Completions Interface. An attacker can gain unauthorized access to restricted resources and potentially disclose or modify sensitive information by manipulating the prompt parameter remotely.

Upgrade litellm to version 1.85.0rc2 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the load_openapi_spec_async() function of the MCP OpenAPI Spec Loader component when processing the spec_path argument. An attacker can access internal resources or services by supplying crafted URLs to the vulnerable parameter.

Upgrade litellm to version 1.84.0 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the /user/filter/ui endpoint. An attacker can gain unauthorized access to user information by sending crafted requests with insufficient authorization checks.

Upgrade litellm to version 1.88.0rc1 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Insufficient Session Expiration in the get_redirect_response_from_openid() function of the SSO Authentication Flow process. An attacker can cause premature session termination by manipulating authentication responses remotely, potentially leading to unauthorized session expiration and disruption of user access.

There is no fixed version for litellm.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the /sso/debug/login and /sso/debug/callback endpoints in the SSO Debug Flow. An attacker can gain unauthorized access and potentially manipulate sensitive information by sending crafted requests to the affected endpoint.

There is no fixed version for litellm.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the /v1/mcp/test/connection endpoint. An attacker can perform server-side request forgery (SSRF) by supplying a crafted token_url and arbitrary Machine-to-Machine (M2M) credentials to the connection testing endpoint. Due to incomplete validation of OAuth M2M flows, the proxy issues HTTP POST requests to attacker-controlled destinations, allowing internal network reconnaissance and potentially triggering unauthorized actions on reachable services.

Note: Exploitation requires an authenticated user with access to the /v1/mcp/test/connection (or /mcp-rest/test/connection) endpoint.

Upgrade litellm to version 1.84.0.dev2 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Incorrect Authorization in the user_api_key_auth.py file of the M2M JWT Handler. An attacker can gain unauthorized access to resources by exploiting insufficient authorization checks.

Note: This is only exploitable if the attacker possesses valid but limited credentials and can craft specific JWTs to bypass intended access controls.

Upgrade litellm to version 1.89.0rc1 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Insufficient Session Expiration in the authenticate_user function. An attacker can gain unauthorized access or maintain access to sensitive information by exploiting session management flaws.

There is no fixed version for litellm.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to User Impersonation via manipulation of the Host header during HTTP requests. An attacker can gain unauthorized access to protected management routes by crafting a malicious Host header that causes the authentication layer to evaluate a different route than intended.

Note: This is only exploitable if there is no upstream component (such as a CDN, WAF, reverse proxy with explicit server name allowlists, or host-based load balancer) validating or normalizing the Host header before forwarding requests.

Upgrade litellm to version 1.84.0 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Incorrect Authorization via the allowed_routes field during API key generation. An attacker can gain unauthorized access to restricted routes by specifying routes outside their permitted scope, thereby bypassing role-based access controls.

Upgrade litellm to version 1.83.14 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Incorrect Authorization via the /user/update endpoint. An attacker can gain full administrative access by modifying their own user_role field to proxy_admin to escalate privileges.

Upgrade litellm to version 1.83.10 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to SQL Injection via the token lookup query in the combined view path. An attacker can extract or manipulate records by supplying a crafted token value that is interpolated directly into the WHERE v.token = '{token}' clause. This affects the proxy’s combined-view token resolution logic and can expose or alter tenant-scoped data returned by the database query.

Workarounds

• Set disable_error_logs: true under general_settings to prevent unauthenticated input from reaching the vulnerable proxy API key verification query path.

Upgrade litellm to version 1.83.7 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the POST /prompts/test endpoint, which accepts user-supplied prompt templates and renders them without sandboxing. An attacker can execute arbitrary code within the server process by submitting a crafted template after authenticating with a valid proxy API key. This may expose sensitive environment variables or allow commands to be executed on the host.

Upgrade litellm to version 1.83.7 or higher.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Command Injection via preview MCP server endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. An attacker can execute arbitrary commands by accessing the publicly exposed MCP management interface and configuring the server with attacker-controlled commands and arguments.

Upgrade litellm to version 1.83.7 or higher.