From c1503d30884ee14fe7169fff16c2675ac49500e1 Mon Sep 17 00:00:00 2001 From: Ryan Crabbe Date: Fri, 17 Apr 2026 18:52:13 -0700 Subject: [PATCH] fix: escape user-controlled greeting in max budget alert email template html.escape() the greeting (user_email/key_alias/token fallback) before inserting into HTML email body to prevent HTML injection via key_alias. --- .../enterprise_callbacks/send_emails/base_email.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py b/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py index 533fb134937..0d508d4bbd8 100644 --- a/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py +++ b/enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py @@ -3,6 +3,7 @@ Base class for sending emails to user after creating keys or invite links """ +import html import json import os from typing import List, Literal, Optional @@ -366,7 +367,9 @@ class BaseEmailLogger(CustomLogger): user_email=event.user_email or recipient_emails[0], event_message=event.event_message, ) - greeting = event.user_email or event.key_alias or event.token or "" + greeting = html.escape( + event.user_email or event.key_alias or event.token or "" + ) email_html_content = MAX_BUDGET_ALERT_EMAIL_TEMPLATE.format( email_logo_url=email_params.logo_url, recipient_email=greeting,