Skip to content

Matched advisory candidates #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
p-linnane merged 1 commit into from
Sep 11, 2026
Merged

Matched advisory candidates #420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions advisories/BREW-aider-CVE-2026-12770.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
{
"schema_version": "1.7.3",
"id": "BREW-aider-CVE-2026-12770",
"published": "2026-09-11T15:21:01Z",
"modified": "2026-09-11T15:21:01Z",
"upstream": [
"GHSA-6qr3-3g89-m4jj",
"CVE-2026-12770"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.47.1"
},
{
"fixed": "0.76.2"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "litellm",
"resource_purl": "pkg:pypi/litellm@1.81.10"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "litellm",
"subject_version": "1.81.10",
"key": "pkg:pypi/litellm@1.81.10",
"resource": "litellm"
}
]
},
"summary": "LiteLLM: Admin Key Handler Has Improper Authorization",
"details": "A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12770"
},
{
"type": "WEB",
"url": "https://github.com/BerriAI/litellm/pull/23781"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/993c68152b2c770d53590f1684c755d4"
},
{
"type": "PACKAGE",
"url": "https://github.com/BerriAI/litellm"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12770"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/811279"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372512"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372512/cti"
}
]
}
92 changes: 92 additions & 0 deletions advisories/BREW-aider-CVE-2026-12771.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
{
"schema_version": "1.7.3",
"id": "BREW-aider-CVE-2026-12771",
"published": "2026-09-11T15:21:01Z",
"modified": "2026-09-11T15:21:01Z",
"upstream": [
"GHSA-qmf3-4767-5fg3",
"CVE-2026-12771"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.47.1"
}
]
}
],
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "litellm",
"resource_purl": "pkg:pypi/litellm@1.81.10"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "litellm",
"subject_version": "1.81.10",
"key": "pkg:pypi/litellm@1.81.10",
"resource": "litellm"
}
]
},
"summary": "LiteLLM: M2M JWT Handler Has Improper Authorization",
"details": "A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12771"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d"
},
{
"type": "PACKAGE",
"url": "https://github.com/BerriAI/litellm"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12771"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/811280"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372513"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372513/cti"
}
]
}
92 changes: 92 additions & 0 deletions advisories/BREW-aider-CVE-2026-12772.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
{
"schema_version": "1.7.3",
"id": "BREW-aider-CVE-2026-12772",
"published": "2026-09-11T15:21:01Z",
"modified": "2026-09-11T15:21:01Z",
"upstream": [
"GHSA-mf52-j94g-746m",
"CVE-2026-12772"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.47.1"
}
]
}
],
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "litellm",
"resource_purl": "pkg:pypi/litellm@1.81.10"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "litellm",
"subject_version": "1.81.10",
"key": "pkg:pypi/litellm@1.81.10",
"resource": "litellm"
}
]
},
"summary": "LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration",
"details": "A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12772"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/39ed709ce322431658a05b951e91f278"
},
{
"type": "PACKAGE",
"url": "https://github.com/BerriAI/litellm"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12772"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/811281"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372514"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372514/cti"
}
]
}
109 changes: 109 additions & 0 deletions advisories/BREW-aider-CVE-2026-12773.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,109 @@
{
"schema_version": "1.7.3",
"id": "BREW-aider-CVE-2026-12773",
"published": "2026-09-11T15:21:01Z",
"modified": "2026-09-11T15:21:01Z",
"upstream": [
"GHSA-4jcj-7x88-m979",
"CVE-2026-12773"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.47.1"
}
]
}
],
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"upstream_fixed_in": "1.84.0",
"resource": "litellm",
"resource_purl": "pkg:pypi/litellm@1.81.10"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "litellm",
"subject_version": "1.81.10",
"key": "pkg:pypi/litellm@1.81.10",
"resource": "litellm"
}
]
},
"summary": "LiteLLM: MCP Proxy Has Improper Authentication",
"details": "A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12773"
},
{
"type": "WEB",
"url": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-12773"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491112"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e"
},
{
"type": "PACKAGE",
"url": "https://github.com/BerriAI/litellm"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12773"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/811282"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372515"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/372515/cti"
}
]
}
Loading