9.8
Critique
CVE-2024-4264 A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the…
Description
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` function unsafely in the `litellm.get_secret()` method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the `eval` function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the `/config/update` endpoint, which allows for the update of settings in `proxy_server_config.yaml`.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| berriai/litellm | Versions non publiées | |
| litellm | Versions non publiées |
Références
- huntr.com huntr.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de berriai/litellm
Les 15 CVE de berriai/litellm →
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
8.8
Élevée
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service…
7.5
Élevée
CVE-2025-0628
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm
8.1
Élevée
CVE-2025-0330
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
7.5
Élevée