fix(caching): read the disk cache through diskcache-community's SafeDisk so a tampered entry cannot run code

litellm/caching/disk_cache.py

@@ -14,15 +14,13 @@ else:
 class DiskCache(BaseCache):
     def __init__(self, disk_cache_dir: str | None = None):
         try:
-            import diskcache as dc
+            import diskcache_community as dc
         except ModuleNotFoundError as e:
             raise ModuleNotFoundError("Please install litellm with `litellm[caching]` to use disk caching.") from e
 
         # if users don't provider one, use the default litellm cache
-        if disk_cache_dir is None:
-            self.disk_cache = dc.Cache(".litellm_cache")
-        else:
-            self.disk_cache = dc.Cache(disk_cache_dir)
+        directory: Final = ".litellm_cache" if disk_cache_dir is None else disk_cache_dir
+        self.disk_cache = dc.Cache(directory, disk=dc.SafeDisk)
 
     def set_cache(self, key, value, **kwargs):
         if "ttl" in kwargs:

osv-scanner.toml

@@ -1,8 +1,3 @@
-[[IgnoredVulns]]
-id = "GHSA-w8v5-vhqr-4h9v"
-ignoreUntil = 2026-11-01
-reason = "diskcache has no fixed release published; remove this entry once one exists"
-
 [[IgnoredVulns]]
 id = "GHSA-vfj7-8cjw-p6xm"
 ignoreUntil = 2026-11-03

pyproject.toml

@@ -122,7 +122,7 @@ utils = [
     # Not in Docker or PyPI proxy extra.
     "numpydoc>=1.8.0,<2.0",
 ]
-caching = ["diskcache>=5.6.3,<6.0"]
+caching = ["diskcache-community>=5.8.0,<6.0"]
 mcp = ["mcp>=2.2.0,<3", "httpx2>=2.5.0,<3", "pydantic>=2.12.0,<3"]
 # Driver for the MongoDB Atlas vector store; Atlas Vector Search has no HTTP query API.
 # The floor is 4.9 because that is the release AsyncMongoClient landed in.

tests/unit/caching/test_disk_cache.py

@@ -4,7 +4,7 @@ from concurrent.futures import ThreadPoolExecutor
 
 import pytest
 
-pytest.importorskip("diskcache")
+pytest.importorskip("diskcache_community")
 
 from litellm.caching.disk_cache import DiskCache
 from tests._wait_helpers import await_until
@@ -17,7 +17,10 @@ class _SlowInt(int):
 
 
 @pytest.fixture
-def cache(tmp_path):
+def cache(tmp_path, monkeypatch: pytest.MonkeyPatch):
+    import diskcache_community
+
+    monkeypatch.setattr(diskcache_community, "SafeDisk", diskcache_community.SafeDisk.with_types(_SlowInt))
     return DiskCache(disk_cache_dir=str(tmp_path))