Critical severity9.8GHSA Advisory· Published May 18, 2024· Updated Apr 15, 2026
CVE-2024-4264
CVE-2024-4264
Description
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.get_secret() method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the /config/update endpoint, which allows for the update of settings in proxy_server_config.yaml.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
litellmPyPI | <= 1.28.11 | — |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-7ggm-4rjg-594wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-4264ghsaADVISORY
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/utils.pyghsaWEB
- huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61nvdWEB
News mentions
0No linked articles in our index yet.