PT-2025-12313 · Unknown · Berriai/Litellm

Published 2025-03-20 · Updated 2025-08-01 · CVE-2025-0330

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions berriai/litellm version 1.52.1

Description An issue in the proxy server.py file causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This exposes sensitive information, including langfuse secret and langfuse public key, potentially granting full access to the Langfuse project and all its stored requests.

Recommendations berriai/litellm version 1.52.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2025-0330

GHSA-879V-FGGM-VXW2

Affected Products

Berriai/Litellm

References · 12

• 🔥 https://huntr.com/bounties/661b388a-44d8-4ad5-862b-4dc5b80be30a · Exploit
• https://osv.dev/vulnerability/GHSA-879v-fggm-vxw2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0330 · Security Note
• https://github.com/BerriAI/litellm · Note
• https://t.me/cvetracker/19519 · Telegram Post
• https://twitter.com/CVEnew/status/1902968891460161818 · Twitter Post
• https://t.me/cvedetector/20722 · Telegram Post
• https://twitter.com/ishaan_jaff/status/1911278383146975442 · Twitter Post
• https://t.me/cveNotify/130532 · Telegram Post
• https://twitter.com/ishaan_jaff/status/1909841515951927600 · Twitter Post
• https://t.me/latest_high_impact_cve/2009 · Telegram Post