Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-9606Improper Output Neutralization for Logs in berriai/litellm

High 7.5

In plain English

A high-severity security flaw in berriai/litellm from berriai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.8%top 44.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	litellm	1.44.12	GHSA-g5pg-73fc-hjwq
PyPI	litellm	1.44.12	PYSEC-2026-1548

Affected products (as reported)

Vendor	Product	Versions
berriai	berriai/litellm	unspecified – before 1.44.12

Weakness: CWE-117 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References