PYSEC-2026-1544
Vulnerability from pysec - Published: 2026-07-07 14:34 - Updated: 2026-07-07 17:24
VLAI
Details
A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.
Severity
4.9 (Medium)
Impacted products
| Name | purl | litellm | pkg:pypi/litellm |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "litellm",
"purl": "pkg:pypi/litellm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.27.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.201",
"0.1.202",
"0.1.203",
"0.1.204",
"0.1.205",
"0.1.206",
"0.1.207",
"0.1.208",
"0.1.209",
"0.1.210",
"0.1.211",
"0.1.212",
"0.1.213",
"0.1.214",
"0.1.215",
"0.1.216",
"0.1.217",
"0.1.218",
"0.1.219",
"0.1.220",
"0.1.221",
"0.1.222",
"0.1.223",
"0.1.224",
"0.1.225",
"0.1.226",
"0.1.227",
"0.1.228",
"0.1.229",
"0.1.2291",
"0.1.230",
"0.1.231",
"0.1.232",
"0.1.233",
"0.1.234",
"0.1.235",
"0.1.236",
"0.1.237",
"0.1.238",
"0.1.3",
"0.1.31",
"0.1.32",
"0.1.330",
"0.1.331",
"0.1.34",
"0.1.341",
"0.1.343",
"0.1.345",
"0.1.347",
"0.1.348",
"0.1.349",
"0.1.351",
"0.1.352",
"0.1.353",
"0.1.354",
"0.1.356",
"0.1.360",
"0.1.361",
"0.1.362",
"0.1.363",
"0.1.364",
"0.1.365",
"0.1.366",
"0.1.367",
"0.1.368",
"0.1.369",
"0.1.370",
"0.1.371",
"0.1.372",
"0.1.373",
"0.1.375",
"0.1.376",
"0.1.379",
"0.1.380",
"0.1.381",
"0.1.383",
"0.1.384",
"0.1.385",
"0.1.386",
"0.1.387",
"0.1.388",
"0.1.389",
"0.1.392",
"0.1.393",
"0.1.394",
"0.1.398",
"0.1.399",
"0.1.400",
"0.1.401",
"0.1.402",
"0.1.403",
"0.1.404",
"0.1.405",
"0.1.410",
"0.1.411",
"0.1.412",
"0.1.415",
"0.1.419",
"0.1.420",
"0.1.421",
"0.1.422",
"0.1.424",
"0.1.425",
"0.1.426",
"0.1.429",
"0.1.433",
"0.1.434",
"0.1.435",
"0.1.436",
"0.1.437",
"0.1.438",
"0.1.439",
"0.1.440",
"0.1.441",
"0.1.442",
"0.1.443",
"0.1.444",
"0.1.445",
"0.1.446",
"0.1.447",
"0.1.448",
"0.1.449",
"0.1.450",
"0.1.451",
"0.1.452",
"0.1.456",
"0.1.457",
"0.1.459",
"0.1.460",
"0.1.461",
"0.1.464",
"0.1.465",
"0.1.475",
"0.1.477",
"0.1.479",
"0.1.480",
"0.1.481",
"0.1.482",
"0.1.486",
"0.1.487",
"0.1.488",
"0.1.490",
"0.1.491",
"0.1.492",
"0.1.493",
"0.1.494",
"0.1.495",
"0.1.497",
"0.1.500",
"0.1.501",
"0.1.504",
"0.1.507",
"0.1.508",
"0.1.509",
"0.1.510",
"0.1.511",
"0.1.512",
"0.1.516",
"0.1.517",
"0.1.518",
"0.1.520",
"0.1.525",
"0.1.530",
"0.1.531",
"0.1.533",
"0.1.535",
"0.1.536",
"0.1.537",
"0.1.538",
"0.1.544",
"0.1.546",
"0.1.547",
"0.1.548",
"0.1.549",
"0.1.550",
"0.1.551",
"0.1.552",
"0.1.553",
"0.1.554",
"0.1.555",
"0.1.556",
"0.1.557",
"0.1.558",
"0.1.559",
"0.1.560",
"0.1.561",
"0.1.562",
"0.1.563",
"0.1.567",
"0.1.568",
"0.1.569",
"0.1.570",
"0.1.574",
"0.1.578",
"0.1.580",
"0.1.582",
"0.1.583",
"0.1.585",
"0.1.586",
"0.1.587",
"0.1.590",
"0.1.591",
"0.1.593",
"0.1.595",
"0.1.596",
"0.1.597",
"0.1.598",
"0.1.600",
"0.1.601",
"0.1.604",
"0.1.605",
"0.1.607",
"0.1.609",
"0.1.610",
"0.1.615",
"0.1.618",
"0.1.619",
"0.1.620",
"0.1.621",
"0.1.623",
"0.1.624",
"0.1.625",
"0.1.626",
"0.1.629",
"0.1.630",
"0.1.631",
"0.1.632",
"0.1.634",
"0.1.635",
"0.1.636",
"0.1.638",
"0.1.639",
"0.1.641",
"0.1.642",
"0.1.643",
"0.1.644",
"0.1.645",
"0.1.646",
"0.1.647",
"0.1.648",
"0.1.649",
"0.1.650",
"0.1.651",
"0.1.652",
"0.1.674",
"0.1.680",
"0.1.681",
"0.1.683",
"0.1.685",
"0.1.686",
"0.1.687",
"0.1.689",
"0.1.690",
"0.1.692",
"0.1.693",
"0.1.696",
"0.1.697",
"0.1.698",
"0.1.700",
"0.1.700.dev0",
"0.1.700.dev1",
"0.1.700.dev2",
"0.1.700.dev3",
"0.1.700.dev4",
"0.1.700.dev5",
"0.1.702",
"0.1.704",
"0.1.706",
"0.1.714",
"0.1.714.dev1",
"0.1.715",
"0.1.716",
"0.1.719",
"0.1.720",
"0.1.721",
"0.1.723",
"0.1.724",
"0.1.729",
"0.1.736",
"0.1.738",
"0.1.743",
"0.1.745",
"0.1.746",
"0.1.747",
"0.1.748",
"0.1.749",
"0.1.750",
"0.1.751",
"0.1.758",
"0.1.765",
"0.1.769",
"0.1.7701",
"0.1.7713",
"0.1.772",
"0.1.774",
"0.1.780",
"0.1.781",
"0.1.784",
"0.1.786",
"0.1.788",
"0.1.789",
"0.1.793",
"0.1.794",
"0.1.805",
"0.1.806",
"0.1.807",
"0.1.813",
"0.1.814",
"0.1.815",
"0.1.816",
"0.1.817",
"0.1.818",
"0.1.819",
"0.1.820",
"0.1.821",
"0.1.824",
"0.10.0",
"0.10.1",
"0.11.1",
"0.12.10",
"0.12.11",
"0.12.12",
"0.12.4",
"0.12.4.dev1",
"0.12.4.dev2",
"0.12.5",
"0.12.5.dev1",
"0.12.7",
"0.12.7.dev1",
"0.12.8",
"0.12.9",
"0.13.0",
"0.13.1",
"0.13.1.dev1",
"0.13.1.dev2",
"0.13.1.dev3",
"0.13.2",
"0.13.2.dev1",
"0.13.3.dev1",
"0.13.3.dev2",
"0.13.6.dev1",
"0.13.6.dev2",
"0.13.6.dev3",
"0.13.7.dev1",
"0.14.0",
"0.14.0.dev1",
"0.14.1",
"0.2.5",
"0.2.6",
"0.3.0",
"0.3.1",
"0.4.0",
"0.4.4",
"0.5.2",
"0.5.3",
"0.5.4",
"0.5.6",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.6",
"0.7.1",
"0.7.1.dev1",
"0.7.1.dev2",
"0.7.1.dev3",
"0.7.10",
"0.7.3",
"0.7.4",
"0.7.5",
"0.7.9",
"0.8.0",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.8.5",
"0.8.6",
"0.9.0",
"0.9.1",
"0.9.2",
"0.9.2.dev1",
"1.0.0",
"1.0.0.dev1",
"1.0.3",
"1.0.3.dev1",
"1.1.0",
"1.1.1",
"1.1.2",
"1.1.3",
"1.10.0",
"1.10.1",
"1.10.10",
"1.10.11",
"1.10.2",
"1.10.3",
"1.10.4",
"1.10.6",
"1.10.8",
"1.10.9",
"1.10.dev11",
"1.11.0",
"1.11.1",
"1.12.0",
"1.12.1",
"1.12.2",
"1.12.3",
"1.12.5",
"1.12.5.dev1",
"1.12.6.dev1",
"1.12.6.dev2",
"1.12.6.dev3",
"1.12.6.dev4",
"1.12.6.dev5",
"1.13.2",
"1.14.0",
"1.14.0.dev1",
"1.14.1",
"1.14.10",
"1.14.2",
"1.14.3",
"1.14.4",
"1.14.5",
"1.14.5.dev1",
"1.14.6",
"1.14.7",
"1.14.8",
"1.14.9",
"1.15.0",
"1.15.1",
"1.15.10",
"1.15.2",
"1.15.3",
"1.15.6",
"1.15.7",
"1.15.8",
"1.16.0",
"1.16.1",
"1.16.11",
"1.16.12",
"1.16.18",
"1.16.19",
"1.16.2",
"1.16.20",
"1.16.21",
"1.16.3",
"1.16.4",
"1.16.5",
"1.16.6",
"1.16.7",
"1.16.8",
"1.16.9",
"1.17.0",
"1.17.2",
"1.17.3",
"1.17.4",
"1.17.5",
"1.17.9",
"1.18.0",
"1.18.1",
"1.18.13",
"1.18.13.dev1",
"1.18.13.dev4",
"1.18.13.dev5",
"1.18.14.dev8",
"1.18.2",
"1.18.6",
"1.18.7",
"1.18.8",
"1.19.4",
"1.2.0",
"1.20.0",
"1.20.5",
"1.20.6",
"1.20.7",
"1.20.8",
"1.20.9",
"1.21.4.dev1",
"1.21.6",
"1.21.7",
"1.22.3",
"1.22.5",
"1.23.0",
"1.23.1",
"1.23.15",
"1.23.16",
"1.23.2",
"1.23.3",
"1.23.5",
"1.24.3",
"1.24.5",
"1.25.0",
"1.25.1",
"1.25.2",
"1.26.0",
"1.26.1",
"1.26.13",
"1.26.3",
"1.26.8",
"1.27.1.dev11",
"1.27.1.dev30",
"1.27.1.dev31",
"1.27.1.dev40",
"1.27.1.dev50",
"1.27.1.dev60",
"1.27.1.dev9",
"1.27.4",
"1.27.6",
"1.27.8",
"1.3.1",
"1.3.3",
"1.3.3.dev1",
"1.3.3.dev2",
"1.3.3.dev3",
"1.4.0",
"1.6.0",
"1.7.1",
"1.7.11",
"1.7.12",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9",
"1.8.1",
"1.9.0",
"1.9.1",
"1.9.2",
"1.9.3",
"1.9.4",
"1.9.5",
"1.9.dev0"
]
}
],
"aliases": [
"CVE-2024-4890",
"GHSA-8j42-pcfm-3467"
],
"details": "A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the \u0027/team/update\u0027 process. The vulnerability arises due to the improper handling of the \u0027user_id\u0027 parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the \u0027user_id\u0027 parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.",
"id": "PYSEC-2026-1544",
"modified": "2026-07-07T17:24:31.329939Z",
"published": "2026-07-07T14:34:34.255023Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4890"
},
{
"type": "WEB",
"url": "https://github.com/BerriAI/litellm/pull/2954"
},
{
"type": "PACKAGE",
"url": "https://github.com/BerriAI/litellm"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/litellm"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8j42-pcfm-3467"
}
],
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SQL injection in litellm"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…