| Component | LiteLLM |
| Severity | medium (CVSS 5.4) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| Published (NVD) | 2025-07-03 |
| Last modified | 2026-06-17 |
| Affected versions | litellm = 1.65.4 |
| Fixed in | see the vendor advisory |
| Weakness | CWE-89 |
| CISA KEV | not listed |
NVD description
SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep LiteLLM off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2025-45809
- https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md
- https://huntr.com/bounties/3e6e4d40-b06a-4f54-a3ed-cc93584b12f3
Read more
Other LiteLLM CVEs
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm...
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of...
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to au...
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated u...
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller...
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated...