AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LiteLLMGHSA-8j42-pcfm-3467

SQL injection in litellm

LiteLLM

CVE-2024-4890 · Published Jun 6, 2024 · updated Sep 10, 2026

Medium4.9
No fix yet
GitHub advisory

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

Affected versions

PackageAffectedFixed in
litellm
PyPI
<= 1.27.14No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-89
Also known as
CVE-2024-4890, PYSEC-2026-1544

More LiteLLM advisories

All LiteLLM