Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

berriai/litellm

              litellm_internal_staging @ b443037
            

519

Fixes

CVEs

CRITICAL

Peak severity

20.5%

Coverage

Highlights

Auth Bypass: 287 prior fixes. Scrutinize any change in this area.

litellm/proxy/management_endpoints/key_management_endpoints.py: most-fixed (37 issues). Treat as high-risk during review.

323 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Authenticated users could execute arbitrary commands on the proxy host by supplying unsanitized command, argument, and environment parameters within the Model Context Protocol (MCP) transport configurations. This was tracked as a critical risk allowing host compromise.

SQL Injection: Unauthenticated attackers could execute arbitrary SQL commands and access or modify database records by manipulating keys and parameters inside raw database query helpers. This bypasses authentication checks entirely via raw string formatting.

Auth Bypass: Inconsistent path parsing using Starlette's host-reconstructed request URLs instead of ASGI scope paths allowed attackers to bypass authentication routing rules entirely, making unauthorized requests to internal administration endpoints.