Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
berriai/litellm
litellm_internal_staging @ c1b6c40
711
Fixes
37
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 439 prior fixes. Scrutinize any change in this area.
litellm/proxy/proxy_server.py: most-fixed (54 issues). Treat as high-risk during review.
406 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical authentication and privilege escalation pathways existed where incoming requests inside Model Context Protocol (MCP) bridge envelopes were admitted under empty, unrestricted default identities instead of enforcing active user API key restrictions, scopes, and revocation checks. This allowed unauthenticated users to execute restricted backend tools.
Remote Code Execution: Insecure handling of custom modules and templates allowed both code injection and remote code execution. Privileged or authenticated users could supply malicious URL-valued paths pointing to S3 or GCS to execute untrusted Python code during config reloading, or exploit un-sandboxed Jinja2 template rendering in prompt testing.
SQL Injection: Vulnerabilities allowed attackers to execute arbitrary SQL commands by manipulating raw query parameters in database helper operations and key checks. Unsafe f-string construction and raw SQL usage were subsequently replaced with type-safe ORM query abstractions via the Prisma Client.