Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

berriai — Vulnerabilities & Security Advisories 44

Browse all 44 CVE security advisories affecting berriai. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Berriai develops AI-powered code analysis tools to help developers identify and fix security vulnerabilities in their applications. Historically, the platform has been associated with vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, with 18 CVEs documented to date. Security researchers have identified issues related to improper input validation and insecure default configurations, though no major public security incidents have been reported. The tool's integration into development workflows creates potential attack surfaces if not properly configured, emphasizing the need for secure implementation practices beyond the tool's own security posture.

Top products by berriai: litellm berriai/litellm
CVE ID Title CVSS Severity Published
CVE-2026-108575 BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization — LiteLLM CWE-285 6.3 Medium 2026-10-11
CVE-2026-108574 BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization — LiteLLM CWE-639 4.3 Medium 2026-10-11
CVE-2026-93355 LiteLLM Weak JWT Authentication via Email-Based User Lookup — litellm CWE-1390 8.1 High 2026-09-28
CVE-2026-89032 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer — litellm CWE-863 7.7 High 2026-09-25
CVE-2026-59823 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy — litellm CWE-918 5.3 Medium 2026-09-16
CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters — litellm CWE-918 6.5 Medium 2026-09-02
CVE-2026-59819 LiteLLM: Local file read via request-supplied OIDC file references — litellm CWE-73 - - 2026-07-08
CVE-2026-59822 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback — litellm CWE-287 8.8 High 2026-07-08
CVE-2026-59820 LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') — litellm CWE-22 - - 2026-07-08
CVE-2026-59821 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks — litellm CWE-94 - - 2026-07-08
CVE-2026-49468 LiteLLM: Authentication Bypass via Host Header Injection — litellm CWE-290 - - 2026-06-22
CVE-2026-12799 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization — litellm CWE-285 4.3 Medium 2026-06-21
CVE-2026-12798 BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery — litellm CWE-918 6.3 Medium 2026-06-21
CVE-2026-12797 BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization — litellm CWE-863 6.3 Medium 2026-06-21
CVE-2026-12796 BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration — litellm CWE-613 6.3 Medium 2026-06-21
CVE-2026-12795 BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication — litellm CWE-306 7.3 High 2026-06-21
CVE-2026-12774 BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery — litellm CWE-918 6.3 Medium 2026-06-21
CVE-2026-12773 BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication — litellm CWE-287 7.3 High 2026-06-21
CVE-2026-12772 BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration — litellm CWE-613 6.3 Medium 2026-06-21
CVE-2026-12771 BerriAI litellm M2M JWT user_api_key_auth.py improper authorization — litellm CWE-285 5.0 Medium 2026-06-21
CVE-2026-12770 BerriAI litellm Admin Key key_management_endpoints.py improper authorization — litellm CWE-285 5.4 Medium 2026-06-21
CVE-2026-47102 LiteLLM < 1.83.10 Privilege Escalation via User Update — litellm CWE-863 8.8 High 2026-05-21
CVE-2026-47101 LiteLLM < 1.83.14 Privilege Escalation via API Key Generation — litellm CWE-863 8.8 High 2026-05-21
CVE-2026-42208 LiteLLM: SQL injection in Proxy API key verification — litellm CWE-89 9.1AI Critical AI 2026-05-08
CVE-2026-42203 LiteLLM: Server-Side Template Injection in /prompts/test endpoint — litellm CWE-1336 9.6AI Critical AI 2026-05-08
CVE-2026-42271 LiteLLM: Authenticated command execution via MCP stdio test endpoints — litellm CWE-77 9.8AI Critical AI 2026-05-08
CVE-2026-40217 LiteLLM 安全漏洞 — LiteLLM CWE-420 8.8 High 2026-04-10
CVE-2026-35030 LiteLLM has an authentication bypass via OIDC userinfo cache key collision — litellm CWE-287 6.5AI Medium AI 2026-04-06
CVE-2026-35029 LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint — litellm CWE-863 8.8AI High AI 2026-04-06
CVE-2024-6825 Remote Code Execution in BerriAI/litellm — berriai/litellm CWE-94 9.8 - 2025-03-20

This page lists every published CVE security advisory associated with berriai. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.