SQL Injection in berriai/litellm (berriai berriai/litellm)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.43 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- @huntr_ai
- NVD status
- Modified
Description
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).
Weaknesses (CWE)
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 6.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | @huntr_ai |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | MEDIUM 6.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | NVD · security@huntr.dev (Secondary) |
Advisories
- GHSA-h6m6-jj8v-94jj — SQL injection in litellm
- PYSEC-2026-1550 — SQL injection in litellm
European references
- ENISA EUVD · EUVD-2024-2064
- GCVE · GCVE-0-2024-5225
Affected configurations (NVD CPE)
cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*≤ 1.40.2
Affected products
| Product | Versions |
|---|---|
| berriai · berriai/litellm | affected unspecified ≤ latest |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |