CVE-2024-4264
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
litellm passes untrusted data to `eval` function without sanitization
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | litellm | <=1.28.11 | |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-4264
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2104-L2108
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2118
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2509-L2517
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2562-L2577
- https://github.com/BerriAI/litellm/blob/main/litellm/utils.py#L9867-L9885
- https://huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61
Verify integrity in audit chain (admin only). AS-IS.