8.8
Élevée
CVE-2024-6825 BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
Description
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| berriai/litellm 1.65 | premières → < 1.65.4.dev6 | 1.65.4.dev6 |
Autres CVE de berriai/litellm
Les 15 CVE de berriai/litellm →
CVE-2024-10188
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service…
7.5
Élevée
CVE-2025-0628
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm
8.1
Élevée
CVE-2025-0330
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
7.5
Élevée
CVE-2024-9606
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a…
7.5
Élevée