CVE-2024-6825

Katalog CVE

CVSS 8.8 · High EPSS 1,7%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada litellm. Skor CVSS 3.0 8.8 (High) menurut huntr.dev.

Deskripsi (NVD)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

8.8 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 75,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5 exploit · advisory pihak ketiga
• https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9