{"id":"CVE-2024-4890","aliases":["GHSA-8j42-pcfm-3467","PYSEC-2026-1544"],"title":"SQL injection in litellm","summary":"SQL injection in litellm","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","vendor":"litellm","product":"litellm","ecosystem":"pip","affected":["litellm <= 1.27.14"],"published":"2024-06-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:15.174348208Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8j42-pcfm-3467","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4890"},{"url":"https://github.com/BerriAI/litellm/pull/2954"},{"url":"https://github.com/BerriAI/litellm"},{"url":"https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2"}],"tags":["osv","pip","exploit-available"],"epss":0.0056,"epssPercentile":0.45149,"exploits":{"github":1,"githubRepos":["https://github.com/nekr0ff/needrestart-sudo-escalate-cve-2024-4890"],"checkedAt":"2026-09-21T15:26:45.445Z"},"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:47.509Z","slug":"CVE-2024-4890","body":"## Overview\n\nA blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.\n\n## Affected packages\n\n- `litellm <= 1.27.14`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4734,"id":"CVE-2024-4890","ts":1788887202990,"field":"exploit_available","old":"false","new":"true"},{"seq":3617,"id":"CVE-2024-4890","ts":1788886319143,"field":"exploit_available","old":"true","new":"false"},{"seq":2471,"id":"CVE-2024-4890","ts":1788882987699,"field":"exploit_available","old":"false","new":"true"},{"seq":1500,"id":"CVE-2024-4890","ts":1788882401247,"field":"exploit_available","old":"true","new":"false"},{"seq":614,"id":"CVE-2024-4890","ts":1788881837887,"field":"exploit_available","old":"false","new":"true"}]}