FixVibe
Covered by FixVibecritical

LiteLLM Aṣoju SQL Abẹrẹ (CVE-2026-42208)

Ailagbara abẹrẹ SQL pataki kan (CVE-2026-42208) ninu paati aṣoju LiteLLM gba awọn olukolu laaye lati fori ijẹrisi tabi wọle si alaye data data ifura nipa lilo ilana ilana ijẹrisi bọtini API.

CVE-2026-42208GHSA-r75f-5x8p-qvmcCWE-89

Ipa

Awọn ẹya LiteLLM 1.81.16 nipasẹ 1.83.7 ni ailagbara abẹrẹ SQL kan laarin aṣoju API ẹrọ ijẹrisi bọtini [S1]. Aṣeyọri ilokulo gba olutaja ti ko ni ifọwọsi lati fori awọn iṣakoso aabo tabi ṣe awọn iṣẹ data laigba aṣẹ [S1]. Ailagbara yii jẹ ipinnu CVSS kan ti 9.8, ti n ṣe afihan ipa giga rẹ lori aṣiri eto ati iduroṣinṣin [S2].

Gbongbo Idi

Ailagbara naa wa nitori aṣoju LiteLLM kuna lati sọ di mimọ tabi parameterize bọtini API ti a pese ni akọsori Authorization ṣaaju lilo rẹ ninu ibeere data [S1]. Eyi ngbanilaaye awọn pipaṣẹ SQL irira ti a fi sinu akọsori lati ṣiṣẹ nipasẹ aaye data ẹhin [S3].

Awọn ẹya ti o fowo

  • LiteLLM *: Awọn ẹya 1.81.16 soke si (sugbon ko pẹlu) 1.83.7 [S1].

Awọn atunṣe Nja

  • Imudojuiwọn LiteLLM *: Lẹsẹkẹsẹ ṣe igbesoke package litellm si ẹya 1.83.7 tabi nigbamii lati pa abawọn abẹrẹ naa [S1].
  • Awọn iforukọsilẹ aaye data ayewo *: Atunwo awọn igbasilẹ wiwọle data data fun awọn ilana ibeere dani tabi sintasi airotẹlẹ ti o wa lati iṣẹ aṣoju [S1].

Imọye Iwari

Awọn ẹgbẹ aabo le ṣe idanimọ ifihan nipasẹ:

  • Ṣiṣayẹwo Ẹya *: Ayika iṣayẹwo ṣe afihan fun awọn ẹya LiteLLM laarin sakani ti o kan (1.81.16 si 1.83.6) [S1].
  • Abojuto Akọsori *: Ṣiṣayẹwo awọn ibeere ti nwọle si aṣoju LiteLLM fun awọn ilana abẹrẹ SQL pataki laarin aaye ami ami Authorization: Bearer [S1].