The increasingly popular AI Gateway LiteLLM has a SQL Injection vulnerability that has been patched in 1.87.3. Check your references and update. You may remember LiteLLM from the supply chain vulnerability discussed here on IFIN a few weeks ago.
3 Likes
Tracked as CVE-2026-42208, CVSS 9.3.
Incredible that folks are still doing string templating for raw SQL. This is why we’ll never be out of work.