LiteLLM proxy pre-auth SQL injection in API key verification

#!/usr/bin/env python3
# Check LiteLLM for CVE-2026-42208
# Usage: python3 check_cve_2026_42208.py /etc/litellm/config.yaml
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys

try:
    from importlib import metadata
except Exception:
    print('UNKNOWN')
    sys.exit(2)


def parse_version(v):
    nums = [int(x) for x in re.findall(r'\d+', v)]
    while len(nums) < 3:
        nums.append(0)
    return tuple(nums[:3])


def version_in_range(v, lower, upper):
    return parse_version(lower) <= parse_version(v) < parse_version(upper)


def config_has_workaround(path):
    if not path:
        return False
    if not os.path.exists(path):
        return False
    try:
        text = open(path, 'r', encoding='utf-8', errors='ignore').read()
    except Exception:
        return False

    # Cheap stdlib-only check. We do not require PyYAML.
    # Accepts forms like:
    # general_settings:
    #   disable_error_logs: true
    general_block = re.search(r'general_settings\s*:(.*?)(?:\n\S|\Z)', text, flags=re.S)
    if general_block and re.search(r'disable_error_logs\s*:\s*true\b', general_block.group(1), flags=re.I):
        return True

    # Fallback if file is flattened or templated.
    if re.search(r'disable_error_logs\s*:\s*true\b', text, flags=re.I):
        return True
    return False


def main():
    cfg = sys.argv[1] if len(sys.argv) > 1 else os.environ.get('LITELLM_CONFIG')

    try:
        version = metadata.version('litellm')
    except metadata.PackageNotFoundError:
        print('UNKNOWN')
        sys.exit(2)
    except Exception:
        print('UNKNOWN')
        sys.exit(2)

    if version_in_range(version, '1.81.16', '1.83.7'):
        if config_has_workaround(cfg):
            # Vulnerable package present, but vendor workaround appears enabled.
            # Treat as UNKNOWN because this is mitigated, not patched.
            print('UNKNOWN')
            sys.exit(2)
        print('VULNERABLE')
        sys.exit(1)

    # Outside the affected range for this CVE.
    print('PATCHED')
    sys.exit(0)


if __name__ == '__main__':
    main()