agentjido/req_llm vulnerabilities

CVEs whose affected-version data names the agentjido/req_llm package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107685Critical· 9.1

yesterday

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate…

▾ Midnightagentjido · req_llmvia CVEORG