Code Injection Affecting litellm package, versions [,1.40.16)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-LITELLM-7361760
- published 30 Jun 2024
- disclosed 15 Jun 2024
- credit trongphuc12
Introduced: 15 Jun 2024
CVE-2024-5751 Open this link in a new tabHow to fix?
Upgrade litellm to version 1.40.16 or higher.
Overview
litellm is a Library to easily interface with LLM API providers
Affected versions of this package are vulnerable to Code Injection via the add_deployment() function, which can decrypt base64 encoded values and assign them to os.eviron variables. An attacker can set some vulnerable values via the /config/update endpoint, which will be set in the environment when the model is invoked. If Google KMS is in use, the model invocation will also trigger a call to get_secret() to retrieve the malicious values which have been decrypted, and pass their values to the eval() function.