PyPI/litellm CVE-2024-4264: high 7.2, EPSS 0.88%
litellm passes untrusted data to `eval` function without sanitization
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.28.11 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-7ggm-4rjg-594w
- https://nvd.nist.gov/vuln/detail/CVE-2024-4264
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2104-L2108
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2118
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2509-L2517
- https://github.com/BerriAI/litellm/blob/main/litellm/proxy/proxy_server.py#L2562-L2577
- https://github.com/BerriAI/litellm/blob/main/litellm/utils.py#L9867-L9885
- https://huntr.com/bounties/a3221b0c-6e25-4295-ab0f-042997e8fc61
CVE-2024-4264 · published · modified · JSON