AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

litellm

Library to easily interface with LLM API providers

Declares an LLM dependency since 2023-07-27 (version 0.1.0).

PyPILatest 1.104.2First release 2023-07-27Registry page RepositoryChecked 2026-10-09

Advisories

Advisories that name litellm as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.

Advisory	Severity	Affected	Fixed in	Published
CVE-2026-49468GHSA-4xpc-pv4p-pm3w: LiteLLM: Authentication Bypass via Host Header Injection	Critical	< 1.84.0	1.84.0	2026-06-16
GHSA-v4p8-mg3p-g94g: LiteLLM: Authenticated command execution via MCP stdio test endpoints	High	>= 1.74.2, < 1.83.7	1.83.7	2026-04-25
GHSA-r75f-5x8p-qvmc: LiteLLM has SQL Injection in Proxy API key verification	Critical	>= 1.81.16, < 1.83.7	1.83.7	2026-04-24
GHSA-xqmj-j6mv-4862: LiteLLM: Server-Side Template Injection in /prompts/test endpoint	High	>= 1.80.5, < 1.83.7	1.83.7	2026-04-24
GHSA-69x8-hrgq-fjj8: LiteLLM: Password hash exposure and pass-the-hash authentication bypass	High	< 1.83.0	1.83.0	2026-04-08
CVE-2026-35030GHSA-jjhc-v7c2-5hh6: LiteLLM: Authentication bypass via OIDC userinfo cache key collision	Critical	< 1.83.0	1.83.0	2026-04-03
CVE-2026-35029GHSA-53mr-6c8q-9789: LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint	High	< 1.83.0	1.83.0	2026-04-03
GHSA-5mg7-485q-xm76: Two LiteLLM versions published containing credential harvesting malware	Critical	>= 1.82.7, <= 1.82.8		2026-03-25

Dependencies of the latest release

As declared in PyPI metadata for version 1.104.2. Optional extras are listed with their extra name.

anthropic[proxy-runtime]Anthropic SDK
google-cloud-aiplatform[google]Google Vertex AI SDK
google-genai[proxy-runtime]Google Gemini SDK
huggingface-hubHugging Face Hub / Transformers
llm-sandbox[proxy-runtime]Model Context Protocol SDK
mcp[proxy]Model Context Protocol SDK
mlflow[mlflow]FastMCP, LangChain
openaiOpenAI SDK
redisvl[extra-proxy]Cohere SDK, FastMCP +5
semantic-router[semantic-router]Cohere SDK, Hugging Face Hub / Transformers +8
sentry-sdk[proxy-runtime]Anthropic SDK, Google Gemini SDK +7
tokenizersHugging Face Hub / Transformers
a2a-sdk[extra-proxy]
aiohttp
apscheduler[proxy]
audioread[stt-nvidia-riva]
aurelio-sdk[semantic-router]
aws-sdk-bedrock-runtime[bedrock-realtime]
azure-ai-contentsafety[proxy-runtime]
azure-identity[proxy]
azure-keyvault-secrets[extra-proxy]
azure-storage-blob[proxy]
azure-storage-file-datalake[proxy-runtime]
backoff[proxy]
boto3
click
cryptography[proxy]
ddtrace[proxy-runtime]
detect-secrets[proxy-runtime]
diskcache[caching]
expression[proxy]
fastapi[proxy]
fastapi-sso[proxy]
fastuuid
filelock
google-cloud-iam[extra-proxy]
google-cloud-kms[extra-proxy]
google-cloud-speech[stt-vertex-chirp]
granian[proxy]
grpcio[grpc]
gunicorn[proxy]
hiredis[proxy]
httpx
httpx2[proxy]
importlib-metadata
inquirerpy[proxy]
jinja2
jsonschema
keyring[cli]
langfuse[proxy-runtime]
litellm-enterprise[proxy]
litellm-proxy-extras[proxy]
mangum[proxy-runtime]
numpy[stt-nvidia-riva]
numpydoc[utils]
nvidia-riva-client[stt-nvidia-riva]
opentelemetry-api[proxy-runtime]
opentelemetry-exporter-otlp[proxy-runtime]
opentelemetry-instrumentation-fastapi[proxy-runtime]
opentelemetry-sdk[proxy-runtime]
orjson[proxy]
packaging
polars[proxy]
prisma[extra-proxy]
prometheus-client[proxy-runtime]
psycopg[extra-proxy]
psycopg-binary[extra-proxy]
pydantic
pydantic-settings
pyjwt[proxy]
pynacl[proxy]
pypdf[proxy-runtime]
pyroscope-io[proxy]
python3-saml[saml]
python-dotenv
python-multipart[proxy]
pyyaml
requests[cli]
resend[extra-proxy]
restrictedpython[proxy]
rich[proxy]
rq[proxy]
soundfile[proxy]
starlette[proxy]
tiktoken
tomlkit[proxy]
uvicorn[proxy]
uvloop[proxy]
websockets[proxy]

Tracked packages that depend on it

Among the packages in the registry; not every dependent on PyPI.