Skip to content
AI Sec Watch
HighVulnerabilityLLM-specific

GHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-g5ff-637f-6q2m
Published
Record updated
View JSON
Affected
  • litellm < 1.95.0
Fixed in
1.95.0

Summary

An authenticated LiteLLM proxy user with only the internal_user_viewer role could send a crafted vertex_ai_credentials value to /utils/transform_request. The request-body blocklist blocked vertex_credentials but missed this alias, letting the value reach the Vertex AI credential loader and read arbitrary local files sent to an attacker-controlled URL. Reading /proc/self/environ can expose LITELLM_MASTER_KEY and provider API keys, escalating to full proxy-admin control.

Mitigation

Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • litellmPyPILLM dependency since 2023-07-27 · 54 tracked dependents

Related items