MAL-2026-2144: Malicious package report
Malicious code in litellm (PyPI)
Published .
Updated .
Reported affected releases: 1.82.7, 1.82.8.
litellm (PyPI)
Known vulnerabilities and malicious package reports for litellm on PyPI, live from OSV, with CISA KEV exploitation status and EPSS scores.
Known package reports
1 malicious package report and 42 vulnerabilities returned by OSV. Check a specific version to see which reports apply.
If you installed a reported malicious release, remove it and rotate the credentials that machine could access. Upgrading does not undo code that already ran.
GHSA-v4p8-mg3p-g94g: Vulnerability
LiteLLM: Authenticated command execution via MCP stdio test endpoints
Published .
Updated .
Affected ranges: introduced 1.74.2, fixed 1.83.7.
Fix versions reported by the advisory: 1.83.7.
Severity: HIGH.
Known to be exploited (CISA KEV).
GHSA-r75f-5x8p-qvmc: Vulnerability
LiteLLM has SQL Injection in Proxy API key verification
Published .
Updated .
Reported affected releases: 1.81.16, 1.82.0, 1.82.1, 1.82.2, 1.82.3, 1.82.4, 1.82.5, 1.82.6, 1.83.0, 1.83.1, 1.83.2, 1.83.3, 1.83.4, 1.83.5, 1.83.6.
Affected ranges: introduced 1.81.16, fixed 1.83.7.
Fix versions reported by the advisory: 1.83.7.
Severity: CRITICAL.
Known to be exploited (CISA KEV).
GHSA-7488-6r32-c95q: Vulnerability
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Published .
Updated .
Affected ranges: introduced 0, fixed 1.84.0.
Fix versions reported by the advisory: 1.84.0.
Severity: HIGH.
Known to be exploited (CISA KEV).
GHSA-g26j-5385-hhw3: Vulnerability
LiteLLM Server-Side Request Forgery (SSRF) vulnerability
Published .
Updated .
Affected ranges: introduced 0, fixed 1.44.8.
Fix versions reported by the advisory: 1.44.8.
Severity: HIGH.
GHSA-53mr-6c8q-9789: Vulnerability
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.0.
Fix versions reported by the advisory: 1.83.0.
Severity: HIGH.
GHSA-wxxx-gvqv-xp7p: Vulnerability
LiteLLM has a sandbox escape in custom-code guardrail
Published .
Updated .
Affected ranges: introduced 1.81.8, fixed 1.83.10.
Fix versions reported by the advisory: 1.83.10.
Severity: HIGH.
GHSA-4xpc-pv4p-pm3w: Vulnerability
LiteLLM: Authentication Bypass via Host Header Injection
Published .
Updated .
Affected ranges: introduced 0, fixed 1.84.0.
Fix versions reported by the advisory: 1.84.0.
Severity: CRITICAL.
GHSA-53gh-p8jc-7rg8: Vulnerability
LiteLLM Vulnerable to Remote Code Execution (RCE)
Published .
Updated .
Affected ranges: introduced 1.40.3.dev2, last_affected 1.40.12.
Severity: HIGH.
GHSA-qrc4-49gv-mv9m: Vulnerability
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.14.
Fix versions reported by the advisory: 1.83.14.
Severity: HIGH.
GHSA-46cm-pfwv-cgf8: Vulnerability
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
Published .
Updated .
Affected ranges: introduced 0, fixed 1.34.42.
Fix versions reported by the advisory: 1.34.42.
Severity: CRITICAL.
GHSA-4jcj-7x88-m979: Vulnerability
LiteLLM: MCP Proxy Has Improper Authentication
Published .
Updated .
Affected ranges: introduced 0, fixed 1.84.0.
Fix versions reported by the advisory: 1.84.0.
Severity: CRITICAL.
GHSA-72m8-9m7m-h278: Vulnerability
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Published .
Updated .
Affected ranges: introduced 0, fixed 1.82.0.
Fix versions reported by the advisory: 1.82.0.
Severity: HIGH.
GHSA-7ggm-4rjg-594w: Vulnerability
litellm passes untrusted data to `eval` function without sanitization
Published .
Updated .
Affected ranges: introduced 0, last_affected 1.28.11.
Severity: CRITICAL.
GHSA-gppg-gqw8-wh9g: Vulnerability
litellm vulnerable to remote code execution based on using eval unsafely
Published .
Updated .
Affected ranges: introduced 0, fixed 1.40.16.
Fix versions reported by the advisory: 1.40.16.
Severity: CRITICAL.
GHSA-jjhc-v7c2-5hh6: Vulnerability
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.0.
Fix versions reported by the advisory: 1.83.0.
Severity: CRITICAL.
GHSA-fh2c-86xm-pm2x: Vulnerability
LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Published .
Updated .
Affected ranges: introduced 0, fixed 1.56.2.
Fix versions reported by the advisory: 1.56.2.
Severity: HIGH.
GHSA-wpfp-gwwc-vwq6: Vulnerability
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.10.
Fix versions reported by the advisory: 1.83.10.
Severity: HIGH.
GHSA-6wvf-77m9-58rm: Vulnerability
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.7.
Fix versions reported by the advisory: 1.83.7.
Severity: CRITICAL.
GHSA-j37q-q7p9-vpwm: Vulnerability
LiteLLM: SSO Debug Flow Has Improper Authentication
Published .
Updated .
Affected ranges: introduced 0, last_affected 1.82.2.
Severity: HIGH.
GHSA-g5pg-73fc-hjwq: Vulnerability
LiteLLM Reveals Portion of API Key via a Logging File
Published .
Updated .
Affected ranges: introduced 0, fixed 1.44.12.
Fix versions reported by the advisory: 1.44.12.
Severity: HIGH.
GHSA-xqmj-j6mv-4862: Vulnerability
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Published .
Updated .
Affected ranges: introduced 1.80.5, fixed 1.83.7.
Fix versions reported by the advisory: 1.83.7.
Severity: HIGH.
GHSA-3xr8-qfvj-9p9j: Vulnerability
Arbitrary file deletion in litellm
Published .
Updated .
Affected ranges: introduced 0, fixed 1.35.36.
Fix versions reported by the advisory: 1.35.36.
Severity: HIGH.
GHSA-5jmr-gcrj-2c9q: Vulnerability
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.7.
Fix versions reported by the advisory: 1.83.7.
Severity: MEDIUM.
GHSA-4g5m-c9r5-49xf: Vulnerability
LiteLLM: Local file read via request-supplied OIDC file references
Published .
Updated .
Affected ranges: introduced 0, fixed 1.83.10.
Fix versions reported by the advisory: 1.83.10.
Severity: MEDIUM.
More reports are available in the interactive package view.
Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.