litellm vulnerable to remote code execution based on using eval unsafely

NGHIÊM TRỌNG 9.8CVE-2024-5751 · GHSA-gppg-gqw8-wh9g · PYSEC-2026-389 · Công bố 27/06/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-5751 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng litellm, litellm (litellm).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.88%, cao hơn 59.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.40.16 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
litellm PyPI	`< 1.40.16`	`1.40.16`
litellm litellm	`= 1.35.8`	Chưa có bản vá

Mô tả

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the add_deployment function, which decodes and decrypts environment variables from base64 and assigns them to os.environ. An attacker can exploit this by sending a malicious payload to the /config/update endpoint, which is then processed and executed by the server when the get_secret function is triggered. This requires the server to use Google KMS and a database to store a model.

Mô tả của NVD

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by the server when the `get_secret` function is triggered. This requires the server to use Google KMS and a database to store a model.