| Package | Affected versions | Patched versions |
|---|---|---|
| openlit | ≥ 1.36.2, < 1.37.1 | 1.37.1 |
| openlit software development kit | ≥ 1.36.2, < 1.37.1 | 1.37.1 |
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the pull_request_target event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged GITHUB_TOKEN and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free