Disclosed weakness · no CVE recorded

LiteLLM text guardrails could miss tool results

LiteLLM · LiteLLM Proxy

First documented disclosure · Review checkpoint

Summary

A text policy could miss sensitive material in a tool result before LiteLLM passed it to the model.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Responses integration omitted tool results from the text supplied to a configured guardrail.

Conditions required

The application uses Responses tool outputs and a guardrail configured to inspect text.

Potential impact

Sensitive data or untrusted instructions in tool results could reach a model without the intended scan.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.109.0 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Check tool results as well as user and model text under the same guardrail.

Operating lesson

Verify the coverage of each input type; inspecting a conversation does not guarantee inspection of tool output.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.109.0. No CVE assignment or complete affected range was established.

Sources