BerriAI LiteLLM Python Package Vulnerability CVE-2026-42208 Enables SQL Injection
Patch LiteLLM to the latest version or apply the security advisory immediately.
Patch LiteLLM to the latest version or apply the security advisory immediately.
Summary
BerriAI’s LiteLLM Python package is affected by CVE-2026-42208, a critical SQL injection flaw with a CVSS score of 9.3. The vulnerability allows an attacker to inject malicious SQL statements that can modify the underlying database schema or data. Security researchers observed active exploitation within 36 hours of the bug’s public disclosure. The flaw can be triggered by any component that processes untrusted input in the LiteLLM package. BerriAI has released a patch and issued a security advisory. Users are advised to update to the latest version immediately to prevent potential data compromise. The issue underscores the importance of input validation in AI libraries.
Key changes
- CVE-2026-42208 is an SQL injection in BerriAI LiteLLM Python package.
- CVSS score 9.3, critical severity.
- Exploitation can modify the underlying database schema.
- Active exploitation observed within 36 hours of disclosure.
- Security advisory issued; patch available.