[Aikido] Fix 38 security issues in vllm, gitpython, litellm and 1 more

[aikido-autofix]

Upgrade vLLM, GitPython, and LiteLLM to fix critical RCE vulnerabilities including arbitrary code execution during model loading, authentication bypass, git hook injection, and JWT cache poisoning.

✅ 38 CVEs resolved by this upgrade, including 8 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-22807	🚨 CRITICAL	[vllm] Unsafe loading of Hugging Face auto_map dynamic modules during model resolution without trust_remote_code validation allows arbitrary code execution at server startup if an attacker can control the model repo/path.
CVE-2026-22778	🚨 CRITICAL	[vllm] Invalid image handling leaks heap addresses, breaking ASLR protections and enabling remote code execution when chained with heap overflow vulnerabilities in image decoders.
CVE-2026-48746	🚨 CRITICAL	[vllm] Authentication bypass in OpenAI API middleware allows attackers to access the API without providing the configured API key by manipulating the Host header to control URL path parsing. This affects exposed instances not behind RFC-conforming web servers.
CVE-2026-27893	HIGH	[vllm] Model implementation files hardcode trust_remote_code=True, bypassing user's security settings and enabling remote code execution (RCE) via malicious model repositories even when explicitly disabled.
CVE-2026-44222	HIGH	[vllm] Token injection vulnerability in multimodal processing allows unauthenticated attackers to inject special tokens via text prompts or supply placeholder sequences without matching data, causing IndexError exceptions that crash workers or degrade service availability.
CVE-2026-41523	HIGH	[vllm] An assert-based security check in activation function loading can be bypassed when running in Python optimized mode, allowing unauthenticated attackers to achieve arbitrary code execution by publishing a malicious HuggingFace model with a crafted config.json.
CVE-2026-24779	HIGH	[vllm] A Server-Side Request Forgery (SSRF) vulnerability in the MediaConnector class allows attackers to bypass host restrictions using differing backslash interpretations between parsing libraries, enabling arbitrary requests to internal network resources and potential denial of service or data access.
CVE-2026-34756	MEDIUM	[vllm] Unauthenticated attackers can send requests with extremely large n parameter values to trigger Denial of Service by blocking the asyncio event loop and causing Out-Of-Memory crashes due to lack of upper bound validation.
CVE-2026-34755	MEDIUM	[vllm] A missing frame count limit in the VideoMediaIO.load_base64() method allows attackers to bypass the num_frames parameter by sending thousands of comma-separated base64-encoded JPEG frames in a single API request, causing out-of-memory denial of service.
CVE-2026-47155	MEDIUM	[vllm] Revision pinning in does not consistently apply to all artifacts loaded for a model, allowing dynamic code, GGUF files, image processors, and side weights to be resolved from unpinned/default revisions instead of the operator-specified reviewed revision, breaking supply-chain integrity guarantees.
CVE-2026-7141	MEDIUM	[vllm] A vulnerability in the KV Block Handler's has_mamba_layers function allows remote attackers to trigger uninitialized resource usage through manipulation of the KV cache interface, potentially leading to denial of service or information disclosure.
CVE-2026-42284	🚨 CRITICAL	[gitpython] A command injection vulnerability in the clone function allows attackers to bypass validation and inject arbitrary Git configuration options, enabling remote code execution through malicious repository hooks during clone operations.
CVE-2026-42215	HIGH	[gitpython] A vulnerability allows attackers to bypass Git option restrictions through Python kwargs in clone, fetch, pull, and push operations, enabling arbitrary command execution when attacker-controlled arguments are passed to these methods.
CVE-2026-35030	🚨 CRITICAL	[litellm] JWT authentication cache uses only the first 20 characters of tokens as keys, allowing attackers to craft tokens matching legitimate users' cached tokens and assume their identity and permissions. This affects deployments with JWT/OIDC authentication enabled.
CVE-2026-49468	🚨 CRITICAL	[litellm] A Host-header parsing flaw in the proxy's authentication layer allows unauthenticated access to protected management routes by crafting a malicious Host header that bypasses auth validation. This vulnerability only affects unprotected deployments lacking upstream Host header validation (CDN, WAF, or reverse proxy).
CVE-2026-42271	🚨 CRITICAL	[litellm] Unauthenticated MCP server preview endpoints allow arbitrary command execution through stdio transport configuration, enabling any authenticated user with a valid API key to run commands with proxy process privileges on the host.
CVE-2026-35029	HIGH	[litellm] Unauthenticated /config/update endpoint allows authenticated users to modify proxy configuration, register malicious handlers, and execute arbitrary code, read files, or hijack admin accounts through environment variable manipulation.
CVE-2026-42203	HIGH	[litellm] The POST /prompts/test endpoint unsafely renders user-supplied prompt templates without sandboxing, allowing authenticated users to execute arbitrary code within the LiteLLM Proxy process and potentially access environment secrets or execute host commands.
GHSA-69x8-hrgq-fjj8	HIGH	[litellm] Weak unsalted SHA-256 password hashing combined with hash exposure in API responses and pass-the-hash login acceptance enables authentication bypass, allowing authenticated users to steal other users' password hashes and escalate privileges.
AIKIDO-2026-10161	MEDIUM	[litellm] Expired API keys are exposed in plaintext error responses, allowing attackers to capture and potentially reuse them if reactivated, violating secret-handling compliance requirements and enabling audit evasion or social engineering attacks.
CVE-2026-34520	🚨 CRITICAL	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
CVE-2025-69223	HIGH	[aiohttp] A zip bomb vulnerability allows attackers to send compressed requests that exhaust server memory when decompressed, causing denial of service. An attacker can trigger excessive memory consumption on the AIOHTTP server through specially crafted compressed payloads.
CVE-2025-69227	HIGH	[aiohttp] A bypass of assert statements when Python optimizations are enabled allows attackers to trigger an infinite loop during POST body processing, causing a denial of service. The vulnerability affects applications using the Request.post() method with optimization flags enabled.
CVE-2025-69228	HIGH	[aiohttp] A vulnerability allows attackers to craft requests that cause uncontrolled memory consumption in servers using the Request.post() method, leading to denial of service through memory exhaustion. An attacker can freeze the server by triggering this memory filling behavior during request processing.
CVE-2026-34515	HIGH	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.
CVE-2026-34516	HIGH	[aiohttp] A response with an excessive number of multipart headers can consume more memory than intended, leading to a denial of service (DoS) vulnerability through resource exhaustion.
CVE-2026-34513	HIGH	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
CVE-2026-22815	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
CVE-2025-69224	MEDIUM	[aiohttp] The Python HTTP parser allows request smuggling attacks when non-ASCII characters are present in pure Python mode, enabling attackers to bypass firewall and proxy protections. This vulnerability could lead to unauthorized request routing and security control evasion.
CVE-2025-69229	MEDIUM	[aiohttp] Chunked message handling causes excessive blocking CPU usage when processing large numbers of chunks, allowing attackers to trigger denial of service by consuming server resources and preventing other requests from being handled.
CVE-2025-69225	MEDIUM	[aiohttp] The HTTP Range header parser accepts non-ASCII decimal characters, potentially enabling request smuggling attacks. While no known exploits exist, this parsing flaw could allow attackers to bypass security controls or manipulate request interpretation.
CVE-2025-69226	MEDIUM	[aiohttp] Path normalization logic in static file handling allows attackers to enumerate absolute path components on the server through information disclosure. This vulnerability affects applications using web.static() and could enable attackers to map the filesystem structure.
CVE-2025-69230	MEDIUM	[aiohttp] A logging storm vulnerability exists where reading multiple invalid cookies can trigger excessive warning-level logs, potentially causing a denial of service through log flooding when an attacker sends a specially crafted Cookie header.
CVE-2026-34525	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
CVE-2026-34514	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
CVE-2026-34517	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
CVE-2026-34518	MEDIUM	[aiohttp] When following redirects to a different origin, the framework fails to drop the Cookie and Proxy-Authorization headers alongside the Authorization header, potentially leaking sensitive authentication credentials to untrusted domains.
CVE-2026-34519	MEDIUM	[aiohttp] is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.