| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| litellm | < 1.83.10 | 1.83.10 |
| litellm | = 1.83.10< 1.83.10 | 1.83.10 |
LiteLLM's /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an oidc/file/ reference.
Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass.
The issue is fixed in 1.83.10-stable.
LiteLLM recommend upgrading to 1.83.10-stable or later.
Restrict /health/test_connection access to trusted administrators only.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí