CVE-2024-4264: litellm passes untrusted data to `eval` function without sanitization
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.getsecret() method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function without any sanitization.
Published May 18, 2024 · Updated May 20, 2024
Affected packages
litellm
- Ecosystem
- PyPI
- Affected
- <= 1.28.11
- Fixed in
- No patched version yet
- Check
pip show litellm
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.get_secret() method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the /config/update endpoint, which allows for the update of settings in proxy_server_config.yaml.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-4264
- https://huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2104-L2108
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2118
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2509-L2517
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2562-L2577
- https://github.com/BerriAI/litellm/blob/main/litellm/utils.py#L9867-L9885
- https://github.com/advisories/GHSA-7ggm-4rjg-594w
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More LiteLLM vulnerabilities
All LiteLLM entriesCVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
medium6.5Sep 30, 2026CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
medium5.3Sep 17, 2026CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
critical9.8Aug 27, 2026CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
low2.1Jul 22, 2026CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
medium6.1Jul 22, 2026CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
low2.1Jul 22, 2026