LOW

GHSA-4g5m-c9r5-49xf

LiteLLM: Local file read via request-supplied OIDC file references

빠른 조치

GHSA-4g5m-c9r5-49xf — litellm: 아래 명령으로 수정 버전으로 올리세요.

pip install --upgrade 'litellm>=1.83.10'

상세

### Impact

LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference.

Because exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass.

### Patches

The issue is fixed in `1.83.10-stable`.

LiteLLM recommend upgrading to `1.83.10-stable` or later.

### Workarounds

Restrict `/health/test_connection` access to trusted administrators only.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / litellm

최초 영향 버전: 0 수정 버전: 1.83.10

수정 pip install --upgrade 'litellm>=1.83.10'

상세

이 버전이 영향받나요?

영향 패키지

참고