CVE-2024-6825High· 8.8▾ TwilightLiteLLM Vulnerable to Remote Code Execution (RCE)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.5%
Last analysed / modified upstream
1.5% → 1.7%
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.
litellm >= 1.40.3.dev2, <= 1.40.12Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59823Medium· 5.3LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2026-12799Medium· 4.3BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
CVE-2026-12796Medium· 6.3BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
CVE-2026-12797Medium· 6.3BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
CVE-2026-12798Medium· 6.3BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
GHSA-69x8-hrgq-fjj8HighLiteLLM: Password hash exposure and pass-the-hash authentication bypass