Critical severity9.8NVD Advisory· Published May 18, 2024· Updated Apr 15, 2026
CVE-2024-4264
CVE-2024-4264
Description
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.get_secret() method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the /config/update endpoint, which allows for the update of settings in proxy_server_config.yaml.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
litellmPyPI | <= 1.28.11 | — |
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- github.com/advisories/GHSA-7ggm-4rjg-594wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-4264ghsaADVISORY
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.pyghsaWEB
- github.com/BerriAI/litellm/blob/main/litellm/utils.pyghsaWEB
- huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61nvdWEB
News mentions
0No linked articles in our index yet.