Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. litellm
  4. ›
  5. GHSA-g5ff-637f-6q2m

GHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

October 27, 2026

An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertex_ai_credentials value to /utils/transform_request. The request-body safety blocklist rejected vertex_credentials but missed its alias vertex_ai_credentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.

References

  • github.com/BerriAI/litellm/commit/065faf6e695be64a1a367601271839914e4a6621
  • github.com/BerriAI/litellm/pull/34189
  • github.com/BerriAI/litellm/releases/tag/v1.95.0
  • github.com/BerriAI/litellm/security/advisories/GHSA-g5ff-637f-6q2m
  • github.com/advisories/GHSA-g5ff-637f-6q2m

Code Behaviors & Features

Detect and mitigate GHSA-g5ff-637f-6q2m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 1.95.0

Fixed versions

  • 1.95.0

Solution

Upgrade to version 1.95.0 or above.

Impact 8.1 HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Source file

pypi/litellm/GHSA-g5ff-637f-6q2m.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:15:47 +0000.