The llm project has published version 0.37.2 containing a security fix that prevents a configured OpenAI API key from being unintentionally sent to third‑party OpenAI‑compatible endpoints. The issue was reported by Daniel de Araujo and is tracked under advisories GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w.
What was the vulnerability?
llm supports an extra-openai-models.yaml mechanism to enable using llm with OpenAI‑compatible API endpoints provided by other vendors. As of 0.37, this configuration is managed via the new "llm openai endpoint add" command.
According to the report, there were two situations in which the configured OpenAI API key could be accidentally transmitted to an external provider:
- if the key referenced by api_key_name had never been stored in the local configuration, or
- if a model with responses: true was executed with the -o chat_completions 1 option.
In those cases the system could forward the OpenAI API key to the endpoints listed in extra-openai-models, creating a potential secret leakage.
What does 0.37.2 change?
The 0.37.2 release modifies how extra-openai-models are handled and adjusts the related command workflow (notably the "llm openai endpoint add" flow) to prevent the accidental disclosure scenarios described above. Users who configure or use external OpenAI‑compatible endpoints via extra-openai-models should upgrade.
Why this matters
OpenAI API keys are sensitive credentials; accidental disclosure to third‑party providers can lead to unauthorized usage and security incidents. This update reduces the risk of such accidental key transmission when using the extra-openai-models functionality.
Report and affected users
The issue was reported by Daniel de Araujo and is recorded under GHSA-v9h7-jj4g-f862 and GHSA-r639-rr7r-x72w. Users employing extra-openai-models.yaml or the "llm openai endpoint add" command to configure OpenAI‑compatible endpoints should apply the 0.37.2 update.
