LiteLLMGHSA-h6m6-jj8v-94jj
SQL injection in litellm
Medium6.4CVE-2024-5225 · Published Jun 6, 2024 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.40.0 | 1.40.0 |
Details and references
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- CVE-2024-5225, PYSEC-2026-1550
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 62024 | Arbitrary file deletion in litellm CVE-2024-4888High6.5fixed in 1.35.36 | High6.5 | 1.35.36 |
| Jun 62024 | SQL injection in litellm CVE-2024-4890Medium4.9no fix yet | Medium4.9 | No fix yet |
| May 182024 | litellm passes untrusted data to `eval` function without sanitization CVE-2024-4264High7.2no fix yet | High7.2 | No fix yet |
| Jun 272024 | litellm vulnerable to remote code execution based on using eval unsafely CVE-2024-5751Critical9.8fixed in 1.40.16 | Critical9.8 | 1.40.16 |
| Jun 272024 | litellm vulnerable to improper access control in team management CVE-2024-5710Medium5.3fixed in 1.40.15 | Medium5.3 | 1.40.15 |
| Apr 102024 | LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint CVE-2024-2952Critical9.8fixed in 1.34.42 | Critical9.8 | 1.34.42 |