CRITICAL 9.9

PYSEC-2026-2246

Details

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / openlit

Introduced in: 1.36.2 Fixed in: 1.37.1

Fix pip install --upgrade 'openlit>=1.37.1'

References

https://github.com/openlit/openlit/commit/4a62039a1659d6cbb8913172693f587b5fc2546c [FIX]
https://github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296q [EVIDENCE]