repository icon
berriai / litellm Project repository

Python SDK, Proxy Server (LLM Gateway) to call 100+ LLM APIs in OpenAI format - [Bedrock, Azure, OpenAI, VertexAI, Cohere, Anthropic, Sagemaker, HuggingFace, Replicate, Groq]

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN29 DAYS

FIX

WITHINN/A DAYS

SSRF via user-controlled api_base in /chat/completions — CVE-2024-6587 bypass/re...
hacnho
duplicate
High
Server-Side Request Forgery (SSRF) via api_base Parameter in /chat/completions
apeiria-zero
self closed
LiteLLM: Complete Authentication Bypass When LITELLM_MASTER_KEY Is Not Set
iamveene
not applicable
SSRF via MCP spec_path parameter in /mcp-rest/test/tools/list endpoint
heejunb
self closed
Remote Code Execution via NFKC Unicode Bypass of Custom Code Guardrail Sandbox
pavanchow
duplicate
Critical
Production Custom Code Guardrail exec() Missing Sandbox Restrictions Present in...
wernerina
duplicate
Critical
Remote Code Execution via Custom Code Guardrail Sandbox Escape
13ph03nix
duplicate
Critical
Remote Code Execution via Custom Code Guardrail Sandbox Escape
seonghoj-bright
duplicate
Critical
Arbitrary File Deletion via Path Traversal in LiteLLM Proxy
locus-x64
informative
High
Remote Code Execution via Custom Code Guardrail Missing Sandbox
spacebrr
not applicable
extra_body Parameter Allows Arbitrary Override of Upstream Provider Request
responsiblereport10
pending
Server-Side Template Injection (SSTI) in /prompts/test Endpoint via Unsandboxed...
jhacksman
duplicate
High
Server-Side Template Injection (SSTI) leading to Remote Code Execution in /promp...
yashvardhantrip
duplicate
Critical
Server-Side Template Injection in /prompts/test endpoint via non-sandboxed Jinja...
lighthousekeeper1212
pending
Race Condition in litellm.Router via user_config Leads to Global Model Registry...
theanubhavk
pending
RCE via file upload
sonw-vh
pending
LiteLLM MCP Client Command Injection Vulnerability
bayuncao-bit
pending
Remote Code Execution (CVE-2024-6825) Fix Bypass
nside-jstrathmann
informative
High
SQL Injection in /key/block and /key/unblock leading to Remote Code Execution
nside-jstrathmann
pending
SQL Injection in litellm proxy spend tracking endpoints
n1lanjan
pending
API2:2023 Broken Authentication - Admin TakeOver
7h3h4ckv157
pending