CVE-2025-45809 — SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints

Back Back to CVE browser

MEDIUM

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints

Published Jul 3, 2025

5.4

MEDIUM

CVSS 3.1

EPSS 0.27%

Description

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.27% 0.00268

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00268

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.27% (0.00268)	17.17th	v5 (v2026.06.15)
Jun 15, 2026	0.25% (0.00253)	16.34th	v5 (v2026.06.15)
Jul 4, 2025	0.02% (0.00023)	4.50th	v4 (v2025.03.14)

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md
ExploitMitigationThird Party Advisory
https://huntr.com/bounties/3e6e4d40-b06a-4f54-a3ed-cc93584b12f3

Link	Providers	Tags
https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md		ExploitMitigationThird Party Advisory
https://huntr.com/bounties/3e6e4d40-b06a-4f54-a3ed-cc93584b12f3

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 3, 2025

Updated Mar 12, 2026

Reserved Apr 22, 2025

Link CVE-2025-45809

CISA Vulnrichment

Updated Jul 3, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2025-45809

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-45809