VEXlitellm
litellm
2 declaraciones, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/litellm/2026-10-13
GHSA-36hh-v3qg-5jq4
no afectado · código vulnerable fuera de la ruta de ejecución- pyo3 0.26.0
PROVEN not reachable. GHSA-36hh is unchecked index + n in pyo3 Iterator::nth/nth_back for PyList/PyTuple iterators (pyo3-0.26.0 src/types/tuple.rs:377/433, list.rs:651/846), reached only by code that calls nth, nth_back, skip or step_by on such an iterator. pyo3 0.26.0 is linked here only by fastuuid 0.14.0 (litellm/_uuid.py imports it), the newest release, whose code does not build on pyo3 0.29 (downcast renamed; cargo build measured 2026-10-13). Checked the fastuuid 0.14.0 sdist: src/lib.rs (517 lines) never iterates a Python list or tuple; the one tuple it takes, UUID(fields=...), is read by fields.len() and get_item(0..5) (src/lib.rs:118-123). grep for iter(, nth, skip, step_by, rev( and new_closure over src/lib.rs returned 0. pyo3 0.26.0 itself calls nth/nth_back only in its #[cfg(test)] modules (grep over src/). The recipe fails the build if any of those calls appears in fastuuid. Verified 2026-10-13.
GHSA-chgr-c6px-7xpp
no afectado · código vulnerable fuera de la ruta de ejecución- pyo3 0.26.0
PROVEN not reachable. GHSA-chgr is PyCFunction::new_closure accepting a closure without a Sync bound (pyo3-0.26.0 src/types/function.rs:73). pyo3 0.26.0 is linked here only by fastuuid 0.14.0, the newest release, which does not build on pyo3 0.29 (measured 2026-10-13). grep for new_closure over the fastuuid 0.14.0 sdist src/ returned 0: fastuuid defines only #[pyclass]/#[pyfunction] items and creates no closure-backed function, so the unsound constructor is never called. The recipe fails the build if new_closure appears in fastuuid src/lib.rs. Verified 2026-10-13.