Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-hc27-fp8v-jue9
SummaryLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
Aliases
0
alias CVE-2026-42208
1
alias GHSA-r75f-5x8p-qvmc
Fixed_packages
0
url pkg:pypi/litellm@1.83.7
purl pkg:pypi/litellm@1.83.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2jce-k6vw-kbe6
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.7
Affected_packages
0
url pkg:pypi/litellm@1.81.16
purl pkg:pypi/litellm@1.81.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.81.16
1
url pkg:pypi/litellm@1.82.0
purl pkg:pypi/litellm@1.82.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.0
2
url pkg:pypi/litellm@1.82.1
purl pkg:pypi/litellm@1.82.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.1
3
url pkg:pypi/litellm@1.82.2
purl pkg:pypi/litellm@1.82.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.2
4
url pkg:pypi/litellm@1.82.3
purl pkg:pypi/litellm@1.82.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.3
5
url pkg:pypi/litellm@1.82.4
purl pkg:pypi/litellm@1.82.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.4
6
url pkg:pypi/litellm@1.82.5
purl pkg:pypi/litellm@1.82.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.5
7
url pkg:pypi/litellm@1.82.6
purl pkg:pypi/litellm@1.82.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-362j-e9vs-73gg
3
vulnerability VCID-cgnq-9qen-6uh6
4
vulnerability VCID-hc27-fp8v-jue9
5
vulnerability VCID-jw3v-fdn2-bugj
6
vulnerability VCID-tssn-kdqp-jbez
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.82.6
8
url pkg:pypi/litellm@1.83.0
purl pkg:pypi/litellm@1.83.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.0
9
url pkg:pypi/litellm@1.83.1
purl pkg:pypi/litellm@1.83.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.1
10
url pkg:pypi/litellm@1.83.2
purl pkg:pypi/litellm@1.83.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.2
11
url pkg:pypi/litellm@1.83.3
purl pkg:pypi/litellm@1.83.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.3
12
url pkg:pypi/litellm@1.83.4
purl pkg:pypi/litellm@1.83.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.4
13
url pkg:pypi/litellm@1.83.5
purl pkg:pypi/litellm@1.83.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.5
14
url pkg:pypi/litellm@1.83.6
purl pkg:pypi/litellm@1.83.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-126s-vxje-v7f7
1
vulnerability VCID-2jce-k6vw-kbe6
2
vulnerability VCID-cgnq-9qen-6uh6
3
vulnerability VCID-hc27-fp8v-jue9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/litellm@1.83.6
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42208.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-42208.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-42208
reference_id
reference_type
scores
0
value 0.6259
scoring_system epss
scoring_elements 0.98406
published_at 2026-06-13T12:55:00Z
1
value 0.6259
scoring_system epss
scoring_elements 0.98405
published_at 2026-06-14T12:55:00Z
2
value 0.6259
scoring_system epss
scoring_elements 0.98399
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-42208
2
reference_url https://github.com/BerriAI/litellm
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/BerriAI/litellm
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-42208
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-42208
4
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2463965
reference_id 2463965
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2463965
6
reference_url https://github.com/advisories/GHSA-r75f-5x8p-qvmc
reference_id GHSA-r75f-5x8p-qvmc
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r75f-5x8p-qvmc
7
reference_url https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
reference_id GHSA-r75f-5x8p-qvmc
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-05-08T17:09:36Z/
url https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
8
reference_url https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
reference_id v1.83.7-stable
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2026-05-08T17:09:36Z/
url https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
Weaknesses
0
cwe_id 89
name Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
0
date_added 2026-05-08
description BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
required_action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
due_date 2026-05-11
notes https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc ; https://nvd.nist.gov/vuln/detail/CVE-2026-42208
known_ransomware_campaign_use false
source_date_published null
exploit_type null
platform null
source_date_updated null
data_source KEV
source_url null
Severity_range_score9.0 - 10.0
Exploitability2.0
Weighted_severity9.0
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-hc27-fp8v-jue9