CVE-2025-45809

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-45809
SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md Exploit Mitigation Third Party Advisory
https://huntr.com/bounties/3e6e4d40-b06a-4f54-a3ed-cc93584b12f3
Configurations

Configuration 1 (hide)

cpe:2.3:a:litellm:litellm:1.65.4:*:*:*:*:*:*:*
History

12 Mar 2026, 17:16

Type Values Removed Values Added
References
  • () https://huntr.com/bounties/3e6e4d40-b06a-4f54-a3ed-cc93584b12f3 -
References () https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md - Exploit, Third Party Advisory, Mitigation () https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md - Exploit, Mitigation, Third Party Advisory
Summary (en) BerriAI litellm v1.65.4 was discovered to contain a SQL injection vulnerability via the /key/block endpoint. (en) SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

01 Aug 2025, 22:23

Type Values Removed Values Added
References () https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md - () https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md - Exploit, Third Party Advisory, Mitigation
First Time Litellm
Litellm litellm
CPE cpe:2.3:a:litellm:litellm:1.65.4:*:*:*:*:*:*:*

08 Jul 2025, 16:19

Type Values Removed Values Added
Summary
  • (es) Se descubrió que BerriAI litellm v1.65.4 contiene una vulnerabilidad de inyección SQL a través del endpoint /key/block.

03 Jul 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-03 19:15

Updated : 2026-03-12 17:16

NVD link : CVE-2025-45809

Mitre link : CVE-2025-45809

CVE.ORG link : CVE-2025-45809

JSON object : View

Products Affected

litellm

  • litellm
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')