GHSA-hhww-mrg2-969h: LiteLLM vulnerable to reflected XSS in /sso/debug/callback

Summary

LiteLLM's proxy endpoint /sso/debug/callback reflected identity-provider-controlled fields into an inline script block using json.dumps, which does not escape HTML context characters such as </script>. An IdP string containing </script> could run attacker JavaScript in the proxy origin. The route needs no authentication, so an attacker with an account on the configured IdP could lure a logged-in proxy admin into opening the callback URL, enabling session cookie theft and potentially full admin account takeover.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 54 tracked dependents

Related items

• Medium'Aokigahara' Stealer Targets 'Developer Keyrings' & AI AssistantsSimilar attack · Dark Reading
• HighGHSA-3w55-933p-8pv5: Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File StorageSimilar attack · GitHub Advisory Database
• HighGHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`Similar attack · GitHub Advisory Database
• HighCVE-2026-117573: hagent OS command injection through args in arduino and esp32 MCP toolsSimilar attack · NVD/CVE Database
• HighCVE-2026-117567: esp-mcp OS command injection through MCP tool parametersSimilar attack · NVD/CVE Database