AI

LLM 0.37.2

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 11/11/2026, 18:42:24 UTC.

Briefings

A security vulnerability in LLM 0.37.2 was fixed by updating the extra-openai-models.yaml configuration file to prevent accidental exposure of OpenAI API keys to external providers. The issue was reported by Daniel de Araujo and addressed via the new-in-0.37 llm openai endpoint add command. The fix applies to all LLM instances using the new-in-0.37 configuration, though specific impact on existing deployments remains to be verified.

Key points

• The LLM 0.37.2 release includes a security fix for a vulnerability reported by Daniel de Araujo in GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w.
• The vulnerability involved the extra-openai-models.yaml configuration file, which could allow API keys to be accidentally sent to external providers if a responses: true model was run with -o chat_completions 1.

Context

The LLM 0.37.2 release addresses a security issue reported by Daniel de Araujo regarding potential exposure of OpenAI API keys. The fix involves updating the extra-openai-models.yaml configuration file to manage LLM usage with OpenAI-compatible API endpoints from other providers.

Limitations

The evidence covers only the security fix and configuration update in LLM 0.37.2. Specific impact on existing deployments, user data exposure rates, or long-term security implications remains unverified and requires further testing.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 11/11/2026, 21:15:16 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeiga4eun6tyn3xlwlykn7nishsc4b6bwqwod3rfr6ytpub3fh6wbxm