What is litellm-vulnerability-research?

This repository collects security research about LiteLLM, a popular tool that many companies use to route requests to different AI models. Rather than being a product to install, it documents three separate security flaws the researcher found while reviewing LiteLLM's source code, along with proof of concept demonstrations for each one. The first finding is an authentication bypass. Because of a logic flaw in how LiteLLM checks API keys, someone who only has a hashed version of a key, rather than the real key itself, can still use it to log in. If that hash belongs to an administrator, the impact could include full account takeover, unauthorized use of paid AI services, and financial cost to the account owner. The second finding involves a feature called custom guardrails, which are meant to add extra safety checks to requests. The research shows these guardrails can make outbound web requests to almost any address, including internal company networks and cloud provider metadata services that often hold sensitive credentials. This could let an attacker scan internal systems or steal cloud secrets. The third finding is a way to escape a supposed sandbox, a restricted environment meant to limit what code can do. The validator that is supposed to block dangerous code checks for certain forbidden text, but it does this before Python's own automatic text normalization runs. That mismatch lets an attacker sneak in blocked commands using different but equivalent character forms, potentially reaching restricted internals, exposing secrets, or running arbitrary code. Each finding has its own folder in the repository with more technical detail and demonstration code. The author identifies themselves and links to a personal website and researcher profile. The repository closes with a clear disclaimer stating everything here is for educational, defensive, and authorized research purposes only, and that any testing should only be done on systems the reader owns or has explicit permission to test.