kadet-hub
Image security report: litellm recipe
litellm: grade D, 17 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 0, HIGH 2, MEDIUM 12, LOW 3, UNKNOWN 0. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
ghcr.io/berriai/litellm:1.108.0@sha256:c560d317136880ea92d62334d4367ab10955b1af189dd3ea24f6551290b1d6c1
CRITICAL 0, HIGH 2, MEDIUM 12, LOW 3, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-112940 | HIGH | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-49272 | HIGH | oauthlib | 4.0.0 | 4.0.1 |
| CVE-2026-101918 | MEDIUM | PyJWT | 2.14.0 | 2.15.0 |
| CVE-2026-102275 | MEDIUM | PyJWT | 2.14.0 | 2.15.0 |
| CVE-2026-112908 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112909 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112910 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112911 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112915 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112935 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112936 | MEDIUM | filelock | 3.32.7 | 4.0.9 |
| CVE-2026-112938 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112939 | MEDIUM | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-114603 | MEDIUM | opentelemetry-api | 1.44.0 | 1.45.1 |
| CVE-2026-112907 | LOW | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112912 | LOW | filelock | 3.32.7 | 4.2.1 |
| CVE-2026-112913 | LOW | filelock | 3.32.7 | 4.2.1 |