Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. litellm
  4. ›
  5. CVE-2024-4264

CVE-2024-4264: litellm passes untrusted data to `eval` function without sanitization

May 18, 2024 (updated May 20, 2024)

A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.get_secret() method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the /config/update endpoint, which allows for the update of settings in proxy_server_config.yaml.

References

  • github.com/BerriAI/litellm
  • github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py
  • github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py
  • github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py
  • github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py
  • github.com/BerriAI/litellm/blob/main/litellm/utils.py
  • github.com/advisories/GHSA-7ggm-4rjg-594w
  • huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61
  • nvd.nist.gov/vuln/detail/CVE-2024-4264

Code Behaviors & Features

Detect and mitigate CVE-2024-4264 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 1.28.11

Solution

Unfortunately, there is no solution available yet.

Impact 9.8 CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

pypi/litellm/CVE-2024-4264.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:46 +0000.