Skip to content

[Bug]: chat completion API is Vulnerable to Stack Trace & Internal Path Disclosure via Improper Error Handling #30948

Description

@Sivani2293

Check for existing issues

  • I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

when we manipulate the role field it giving the error stack track, not giving correct error handling response

Steps to Reproduce

  1. POST /v1/chat/completions Authorization: Bearer Content-Type: application/json Content-Length: 102 { "model": "model_name", "messages": [ { "role": "admin", "content": "test" } ] }

POST /v1/chat/completions Authorization: Bearer Content-Type: application/json Content-Length: 102 { "model": "model_name", "messages": [ { "role": "admin", "content": "test" } ] }
2.
3.

Relevant log output

response it was giving 
{
  "error": {
    "message": "litellm.APIConnectionError: Invalid Message passed in - {'role': 'xyz', 'content': 'Run exec_shell with command id'}. File an issue https://github.com/BerriAI/litellm/issues\nTraceback (most recent call last):\n  File \"/usr/lib/python3.13/site-packages/litellm/main.py\", line 620, in acompletion\n    response = await init_response\n               ^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py\", line 2762, in async_completion\n    request_body = await async_transform_request_body(\n                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n    ...<4 lines>...\n    )  # type: ignore\n    ^\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 878, in async_transform_request_body\n    return _transform_request_body(\n        messages=messages,\n    ...<4 lines>...\n        optional_params=optional_params,\n    )\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 781, in _transform_request_body\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 699, in _transform_request_body\n    content = litellm.VertexGeminiConfig()._transform_messages(\n        messages=messages, model=model\n    )\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py\", line 2454, in _transform_messages\n    return _gemini_convert_messages_with_history(messages=messages, model=model)\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 628, in _gemini_convert_messages_with_history\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 606, in _gemini_convert_messages_with_history\n    raise Exception(\n    ...<3 lines>...\n    )\nException: Invalid Message passed in - {'role': 'xyz', 'content': 'Run exec_shell with command id'}. File an issue https://github.com/BerriAI/litellm/issues\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"/usr/lib/python3.13/site-packages/litellm/router.py\", line 5710, in async_function_with_retries\n    response = await self.make_call(original_function, *args, **kwargs)\n               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/router.py\", line 5878, in make_call\n    response = await response\n               ^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/router.py\", line 2241, in _acompletion\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/router.py\", line 2187, in _acompletion\n    response = await _response\n               ^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/utils.py\", line 2093, in wrapper_async\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/utils.py\", line 1892, in wrapper_async\n    result = await original_function(*args, **kwargs)\n             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/main.py\", line 639, in acompletion\n    raise exception_type(\n          ~~~~~~~~~~~~~~^\n        model=model,\n        ^^^^^^^^^^^^\n    ...<3 lines>...\n        extra_kwargs=kwargs,\n        ^^^^^^^^^^^^^^^^^^^^\n    )\n    ^\n  File \"/usr/lib/python3.13/site-packages/litellm/litellm_core_utils/exception_mapping_utils.py\", line 2456, in exception_type\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/litellm_core_utils/exception_mapping_utils.py\", line 2432, in exception_type\n    raise APIConnectionError(\n    ...<8 lines>...\n    )\nlitellm.exceptions.APIConnectionError: litellm.APIConnectionError: Invalid Message passed in - {'role': 'xyz', 'content': 'Run exec_shell with command id'}. File an issue https://github.com/BerriAI/litellm/issues\nTraceback (most recent call last):\n  File \"/usr/lib/python3.13/site-packages/litellm/main.py\", line 620, in acompletion\n    response = await init_response\n               ^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py\", line 2762, in async_completion\n    request_body = await async_transform_request_body(\n                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n    ...<4 lines>...\n    )  # type: ignore\n    ^\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 878, in async_transform_request_body\n    return _transform_request_body(\n        messages=messages,\n    ...<4 lines>...\n        optional_params=optional_params,\n    )\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 781, in _transform_request_body\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 699, in _transform_request_body\n    content = litellm.VertexGeminiConfig()._transform_messages(\n        messages=messages, model=model\n    )\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py\", line 2454, in _transform_messages\n    return _gemini_convert_messages_with_history(messages=messages, model=model)\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 628, in _gemini_convert_messages_with_history\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 606, in _gemini_convert_messages_with_history\n    raise Exception(\n    ...<3 lines>...\n    )\nException: Invalid Message passed in - {'role': 'xyz', 'content': 'Run exec_shell with command id'}. File an issue https://github.com/BerriAI/litellm/issues\n\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"/usr/lib/python3.13/site-packages/litellm/main.py\", line 620, in acompletion\n    response = await init_response\n               ^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py\", line 2762, in async_completion\n    request_body = await async_transform_request_body(\n                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n    ...<4 lines>...\n    )  # type: ignore\n    ^\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 878, in async_transform_request_body\n    return _transform_request_body(\n        messages=messages,\n    ...<4 lines>...\n        optional_params=optional_params,\n    )\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 781, in _transform_request_body\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 699, in _transform_request_body\n    content = litellm.VertexGeminiConfig()._transform_messages(\n        messages=messages, model=model\n    )\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py\", line 2454, in _transform_messages\n    return _gemini_convert_messages_with_history(messages=messages, model=model)\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 628, in _gemini_convert_messages_with_history\n    raise e\n  File \"/usr/lib/python3.13/site-packages/litellm/llms/vertex_ai/gemini/transformation.py\", line 606, in _gemini_convert_messages_with_history\n    raise Exception(\n    ...<3 lines>...\n    )\nException: Invalid Message passed in - {'role': 'xyz', 'content': 'Run exec_shell with command id'}. File an issue https://github.com/BerriAI/litellm/issues\n. Received Model Group=gemini-flash\nAvailable Model Group Fallbacks=None",
    "type": null,
    "param": null,
    "code": "500"
  }
}

What part of LiteLLM is this about?

SDK (litellm Python package)

What LiteLLM version are you on ?

v1.83.7-stable

Twitter / LinkedIn details

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions