Remote Code Execution in berriai/litellm
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` function unsafely in the `litellm.get_secret()` method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the `eval` function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the `/config/update` endpoint, which allows for the update of settings in `proxy_server_config.yaml`.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BerriAI | berriai/litellm | up to latest | — | No fix listed | CNA |
| — | litellm (PyPI) | up to 1.28.11 | — | No fix listed | GHSA-7ggm-4rjg-594w |
- berriai/litellm VendorBerriAI Affected up to latest Fixed in — No fix listed CNA
- litellm (PyPI) Vendor— Affected up to 1.28.11 Fixed in — No fix listed GHSA-7ggm-4rjg-594w
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4264
- 2026-10-03 Alias added: GHSA-7ggm-4rjg-594w
References
Other 7
- https://huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2104-L2108
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2118
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2509-L2517
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2562-L2577
- https://github.com/BerriAI/litellm/blob/main/litellm/utils.py#L9867-L9885
More BerriAI vulnerabilities
- TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
- TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
- TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
- TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
- TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
- TI-2024-02760 Server-Side Template Injection in BerriAI/litellm CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-4264 · CVE Program
- CVE-2024-4264 · NVD
- FIRST EPSS
- GHSA-7ggm-4rjg-594w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences